[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #391056 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, October 28, 2025 3:12:22 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #391056 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 391056

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  40396800      134656        24.1%          52.222.136.65
  17977200       59924        10.7%         52.222.136.125
  11123400       37078         6.6%          52.222.136.15
  11056800       36856         6.6%         52.222.136.124
   5204700       17349         3.1%          192.114.3.241
   4728900       15763         2.8%          132.64.59.153
   4683900       15613         2.8%   2001:bf8:900:d:2::71
   3010500       10035         1.8%            132.70.19.4
   2992500        9975         1.8%        128.139.225.245
   2070900        6903         1.2%          16.15.207.180

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  80555700      268519        48.0%     132.70.60.180
   5336700       17789         3.2%   142.250.180.138
   5282100       17607         3.1%     13.107.136.10
   4185900       13953         2.5%   128.139.225.245
   3347100       11157         2.0%     132.65.180.20
   3010500       10035         1.8%     20.209.177.33
   2799300        9331         1.7%     128.139.200.5
   2479800        8266         1.5%     128.139.200.4
   2070900        6903         1.2%     132.65.43.161
   1911900        6373         1.1%       192.114.7.2

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                        443   132.70.60.180               119101190700
                              132.70.60.180               119101190700
   52.222.136.65        443                                59726868300
   52.222.136.65                                           59726868300
  52.222.136.125        443                                26581195800
  52.222.136.125                                           26581195800
   52.222.136.15        443                                16445842200
   52.222.136.15                                           16445842200
  52.222.136.124        443                                16346743200
  52.222.136.124                                           16346743200

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-10-28 01:12:12
End Time: ongoing

First Event Seen: 2025-10-28 01:10:00
Last Event Seen: 2025-10-28 01:11:00

Further Details:
https://primary.nemo.geant.org/alerts/details/391056/