[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #215890 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, October 6, 2025 8:26:40 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #215890 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 215890

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  61365000      204550        45.7%   2001:bf8:900:d:2::71
   5983800       19946         4.5%          162.125.65.14
   4418400       14728         3.3%          132.66.46.209
   4272300       14241         3.2%          132.73.124.48
   2254800        7516         1.7%            132.70.19.4
   1147800        3826         0.9%          132.74.74.134
   1147200        3824         0.9%        104.153.233.181
   1140900        3803         0.8%           192.114.2.35
   1076700        3589         0.8%          192.114.7.130
   1041000        3470         0.8%         132.64.145.222

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total                          Dst IP
-----------------------------------------------------------------
  6866100       22887         5.1%            2001:b30:4202:100::9
  5983800       19946         4.5%                  132.73.124.180
  5888400       19628         4.4%        2001:1470:ff8a:6d:d14::6
  5322900       17743         4.0%        2001:1470:ff8a:6d:d14::3
  5091900       16973         3.8%        2001:1470:ff8a:6d:d14::4
  4437600       14792         3.3%        2001:1470:ff8a:6d:d14::2
  4164900       13883         3.1%                 128.139.225.245
  4140300       13801         3.1%                   162.125.69.14
  3905700       13019         2.9%   2001:1470:ff94:d:153:5:68:168
  3501900       11673         2.6%        2001:1470:ff8a:6d:d14::8

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                     Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                           91938287400
  2001:bf8:900:d:2::71                                                      91938287400
         162.125.65.14        443                                            8968376400
         162.125.65.14                                                       8968376400
                              443             132.73.124.180                 8968376400
                                              132.73.124.180                 8968376400
                             8443   2001:1470:ff8a:6d:d14::6                 8826184200
                                    2001:1470:ff8a:6d:d14::6                 8826184200
                             8443       2001:b30:4202:100::9                 8729860200
                                        2001:b30:4202:100::9                 8729860200

Metric Info:
793k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-10-06 17:26:29
End Time: ongoing

First Event Seen: 2025-10-06 17:24:00
Last Event Seen: 2025-10-06 17:25:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/215890/