[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #215813 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, October 5, 2025 9:19:35 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #215813 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 215813

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  17962500       59875        12.3%         52.222.136.124
  16875600       56252        11.6%          52.222.136.15
  14804400       49348        10.2%         52.222.136.125
  12868800       42896         8.8%          52.222.136.65
   9908400       33028         6.8%   2001:bf8:900:d:2::71
   4556100       15187         3.1%          132.66.46.209
   2652000        8840         1.8%          132.73.124.88
   2291100        7637         1.6%            132.70.19.4
   1881900        6273         1.3%          184.25.86.218
   1630200        5434         1.1%         151.101.74.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                 Dst IP
---------------------------------------------------------
  62517900      208393        43.0%          132.70.60.180
   3905100       13017         2.7%      2001:760:4228::26
   3663000       12210         2.5%      2001:760:4228::47
   3565800       11886         2.5%          128.139.200.4
   2340300        7801         1.6%   2001:b30:4202:100::8
   2291100        7637         1.6%          20.209.177.33
   2141700        7139         1.5%          128.139.200.5
   2045100        6817         1.4%        142.250.180.170
   2000100        6667         1.4%         192.114.91.243
   1874700        6249         1.3%          13.107.136.10

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                        443   132.70.60.180                92443836600
                              132.70.60.180                92443836600
  52.222.136.124        443                                26562767700
  52.222.136.124                                           26562767700
   52.222.136.15        443                                24957874500
   52.222.136.15                                           24957874500
  52.222.136.125        443                                21891623400
  52.222.136.125                                           21891623400
   52.222.136.65        443                                19028627400
   52.222.136.65                                           19028627400

Metric Info:
770k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-10-05 18:19:25
End Time: ongoing

First Event Seen: 2025-10-05 18:17:00
Last Event Seen: 2025-10-05 18:18:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/215813/