[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #217107 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, October 17, 2025 5:53:36 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #217107 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 217107

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  10717200       35724         6.7%   165.227.143.188
   9670200       32234         6.0%    64.226.126.211
   9638700       32129         6.0%   134.209.239.127
   5232600       17442         3.3%       192.114.7.2
   3699600       12332         2.3%   149.165.224.210
   3644400       12148         2.3%   149.165.224.218
   3578400       11928         2.2%   149.165.224.208
   3195300       10651         2.0%   149.165.224.212
   3034500       10115         1.9%   149.165.224.216
   2597700        8659         1.6%       132.70.19.4

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                     Dst IP
-------------------------------------------------------------
  17152200       57174        10.7%            192.114.101.113
   4891500       16305         3.1%            128.139.225.245
   3010500       10035         1.9%              128.139.200.4
   2990700        9969         1.9%              128.139.200.5
   2597700        8659         1.6%              20.209.177.33
   1692000        5640         1.1%             74.125.247.128
   1532100        5107         1.0%   2001:1470:ff8a:6d:dc::18
   1428000        4760         0.9%                192.114.7.2
   1409100        4697         0.9%               192.114.52.1
   1159500        3865         0.7%                132.70.19.4

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               192.114.101.113                25723111200
      192.114.7.2                                              7419223500
      192.114.7.2                                     443      7417093800
                               128.139.225.245                 5654552100
  149.165.224.210      23148                                   5548036800
  149.165.224.210                                   45180      5548036800
  149.165.224.210                                              5548036800
                       23148   192.114.101.113                 5548036800
                               192.114.101.113      45180      5548036800
  149.165.224.218      22704                                   5465868000

Metric Info:
853k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-10-17 14:53:19
End Time: ongoing

First Event Seen: 2025-10-17 14:51:00
Last Event Seen: 2025-10-17 14:52:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/217107/