[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #391086 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, October 28, 2025 5:02:23 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #391086 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 391086

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  33527700      111759        20.2%         52.222.136.124
  17522100       58407        10.6%          52.222.136.65
  15761400       52538         9.5%         52.222.136.125
  12475200       41584         7.5%          52.222.136.15
   7498200       24994         4.5%   2001:bf8:900:d:2::71
   7212900       24043         4.3%          192.114.3.241
   4675800       15586         2.8%          132.73.124.48
   3246000       10820         2.0%            132.70.19.4
   1841700        6139         1.1%          16.15.207.180
   1801200        6004         1.1%         132.73.124.172

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                       Dst IP
---------------------------------------------------------------
  79290600      264302        47.8%                132.70.60.180
   4608000       15360         2.8%                162.125.69.14
   4495800       14986         2.7%                13.107.136.10
   3817500       12725         2.3%              192.114.101.113
   3813300       12711         2.3%                132.65.180.20
   3246000       10820         2.0%                20.209.177.33
   3090600       10302         1.9%   2001:760:4205:128::129:201
   3041100       10137         1.8%               216.58.204.234
   2583000        8610         1.6%    2001:760:4205:128::130:70
   2535000        8450         1.5%              128.139.225.245

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
                        443   132.70.60.180               117221145900
                              132.70.60.180               117221145900
  52.222.136.124        443                                49571235000
  52.222.136.124                                           49571235000
   52.222.136.65        443                                25904475600
   52.222.136.65                                           25904475600
  52.222.136.125        443                                23298550800
  52.222.136.125                                           23298550800
   52.222.136.15        443                                18441454500
   52.222.136.15                                           18441454500

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-10-28 03:02:13
End Time: ongoing

First Event Seen: 2025-10-28 03:00:00
Last Event Seen: 2025-10-28 03:01:00

Further Details:
https://primary.nemo.geant.org/alerts/details/391086/