[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #215592 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, October 4, 2025 6:39:39 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #215592 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 215592

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total                 Src IP
----------------------------------------------------------
  126615300      422051        46.0%   2001:bf8:900:d:2::71
   64497900      214993        23.4%         52.222.136.125
    9510600       31702         3.5%          52.222.136.65
    9383400       31278         3.4%         52.222.136.124
    7568100       25227         2.7%          52.222.136.15
    4441200       14804         1.6%          132.68.17.204
    4233000       14110         1.5%          132.66.46.209
    3030600       10102         1.1%          192.114.3.241
    1268100        4227         0.5%          132.74.74.134
    1147500        3825         0.4%            132.70.19.4

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                         Dst IP
-----------------------------------------------------------------
  90965400      303218        33.0%                  132.70.60.180
  37987800      126626        13.8%   2001:4118:1a:2c10:0:a5:5e:11
  36795300      122651        13.4%   2001:4118:1a:2c10:0:a5:5e:14
  29611500       98705        10.7%   2001:4118:1a:2c10:0:a5:5e:13
   9426600       31422         3.4%    2001:4118:1a:2c10:0:a5:5e:9
   5209800       17366         1.9%              2001:760:4228::40
   4750500       15835         1.7%                  162.125.69.12
   3463200       11544         1.3%             2001:760:4228::200
   3412200       11374         1.2%             2001:760:4228::109
   2332200        7774         0.8%                  13.107.136.10

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                         Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                              189784801800
  2001:bf8:900:d:2::71                                                         189784801800
                              443                  132.70.60.180               134516819100
                                                   132.70.60.180               134516819100
        52.222.136.125        443                                               95385320700
        52.222.136.125                                                          95385320700
                             8443   2001:4118:1a:2c10:0:a5:5e:11                56950077000
                                    2001:4118:1a:2c10:0:a5:5e:11                56950077000
                             8443   2001:4118:1a:2c10:0:a5:5e:14                55155440400
                                    2001:4118:1a:2c10:0:a5:5e:14                55155440400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-10-04 03:39:25
End Time: ongoing

First Event Seen: 2025-10-04 03:37:00
Last Event Seen: 2025-10-04 03:38:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/215592/