[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #383899 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, September 2, 2025 2:49:48 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #383899 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 383899

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  74209500      247365        20.1%   23.220.255.161
  73262100      244207        19.8%   23.220.255.172
  18190500       60635         4.9%    132.73.124.68
  16158600       53862         4.4%    132.73.124.48
   9361500       31205         2.5%   23.220.255.150
   8743200       29144         2.4%    132.73.124.96
   7437000       24790         2.0%    104.83.83.214
   5005800       16686         1.4%    132.73.124.40
   4886400       16288         1.3%     132.73.124.8
   4786200       15954         1.3%    132.73.124.72

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total           Dst IP
---------------------------------------------------
  38042700      126809        10.3%   23.220.255.161
  37706100      125687        10.2%    132.73.124.68
  37140000      123800        10.0%   23.220.255.172
  27396900       91323         7.4%    132.73.124.48
  17736900       59123         4.8%    132.73.124.96
  10391700       34639         2.8%    132.73.124.40
  10033800       33446         2.7%    132.73.124.72
   9477900       31593         2.6%     132.73.124.8
   7650300       25501         2.1%    132.73.124.60
   6830400       22768         1.8%    132.71.146.63

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
  23.220.255.161        443                               111109723200
  23.220.255.161                                          111109723200
  23.220.255.172        443                               109689179100
  23.220.255.172                                          109689179100
                        443   132.73.124.68                55917034500
                              132.73.124.68                55917034500
                              132.73.124.48                40172005200
                        443   132.73.124.48                39825355500
                              132.73.124.96                26149740300
                        443   132.73.124.96                26146802400

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-09-01 23:45:37
End Time: ongoing

First Event Seen: 2025-09-01 23:43:00
Last Event Seen: 2025-09-01 23:48:00

Further Details:
https://primary.nemo.geant.org/alerts/details/383899/