[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #390872 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, October 26, 2025 11:23:25 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #390872 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 390872

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  7588200       25294         4.2%    132.73.124.72
  6756900       22523         3.7%   57.144.248.192
  6114000       20380         3.4%   57.144.244.192
  6112200       20374         3.4%   157.240.253.63
  5981700       19939         3.3%     132.73.124.8
  4849200       16164         2.7%   132.64.244.122
  4188600       13962         2.3%    192.114.3.241
  3723300       12411         2.1%    132.73.124.48
  3554100       11847         2.0%    132.73.124.68
  3363600       11212         1.9%   132.73.124.216

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  33880500      112935        18.7%    142.251.209.46
  17547600       58492         9.7%   128.139.225.245
  16579500       55265         9.2%    216.58.204.142
   5831100       19437         3.2%       23.41.187.5
   5795400       19318         3.2%     128.139.200.5
   5001900       16673         2.8%      23.41.187.31
   4840500       16135         2.7%   192.178.156.207
   4696500       15655         2.6%     128.139.200.4
   3821400       12738         2.1%     13.107.136.10
   3073500       10245         1.7%     20.209.177.33

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                              128.139.225.245                21155477100
                        443   128.139.225.245                19574505600
  57.144.248.192        443                                   8304604200
  57.144.248.192                                              8304604200
                                128.139.200.5                 7640172600
                        443     128.139.200.5                 7639666500
  157.240.253.63        443                                   7458035100
  157.240.253.63                                              7458035100
  57.144.244.192        443                                   7451915100
  57.144.244.192                                              7451915100

Metric Info:
1018k Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-10-26 21:23:12
End Time: ongoing

First Event Seen: 2025-10-26 21:21:00
Last Event Seen: 2025-10-26 21:22:00

Further Details:
https://primary.nemo.geant.org/alerts/details/390872/