[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #214646 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, September 22, 2025 5:54:02 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #214646 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 214646

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  61194000      203980        32.6%         109.205.211.35
  13865400       46218         7.4%          132.74.112.76
   6120300       20401         3.3%         142.251.209.42
   4554300       15181         2.4%   2001:bf8:900:d:2::71
   4444500       14815         2.4%          132.73.124.48
   4122300       13741         2.2%        149.165.224.213
   3855600       12852         2.1%          104.83.83.214
   3743700       12479         2.0%          192.114.3.241
   2573400        8578         1.4%         194.180.48.154
   2358600        7862         1.3%           132.76.61.53

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                          Dst IP
------------------------------------------------------------------
  14523000       48410         7.7%                  142.251.209.42
   6102600       20342         3.3%                   162.125.69.14
   4147800       13826         2.2%                   132.74.112.76
   4124100       13747         2.2%                 192.114.101.113
   3987000       13290         2.1%                 128.139.225.245
   3741600       12472         2.0%                   13.107.138.10
   2712600        9042         1.4%                   128.139.200.4
   2614800        8716         1.4%   2001:1470:ff94:d:153:5:68:161
   2112300        7041         1.1%                   192.114.3.241
   1917900        6393         1.0%   2001:1470:ff94:d:153:5:68:169

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
                                    142.251.209.42        443     20224651200
                                    142.251.209.42                20224651200
         132.74.112.76                                    443     20097130500
         132.74.112.76                                            20097130500
         132.74.112.76      58202                                 20096846400
                            58202   142.251.209.42                20096846400
                                     162.125.69.14        443      8301606300
                                     162.125.69.14                 8301606300
  2001:bf8:900:d:2::71       8443                                  6783177600
  2001:bf8:900:d:2::71                                             6783177600

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-09-22 14:53:47
End Time: ongoing

First Event Seen: 2025-09-22 14:51:00
Last Event Seen: 2025-09-22 14:52:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/214646/