[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #214970 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, September 26, 2025 7:44:04 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #214970 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 214970

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  40575300      135251        17.0%          23.213.161.12
  32753100      109177        13.7%          23.213.161.20
  19837800       66126         8.3%   2001:bf8:900:d:2::71
   3570000       11900         1.5%          13.107.138.10
   3329400       11098         1.4%         142.251.209.42
   3305700       11019         1.4%         142.251.209.10
   3291000       10970         1.4%           132.69.32.30
   2784900        9283         1.2%          192.114.3.241
   2110800        7036         0.9%            132.70.19.4
   1986300        6621         0.8%          52.98.243.146

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                    Dst IP
------------------------------------------------------------
  28584600       95282        12.0%             23.213.161.12
  22822500       76075         9.6%             23.213.161.20
   4177200       13924         1.8%            216.58.204.234
   3241200       10804         1.4%             132.74.74.134
   3082800       10276         1.3%   2001:4118:900:cc00::156
   3060600       10202         1.3%             13.107.138.10
   3050400       10168         1.3%   2001:4118:900:cc00::146
   3047400       10158         1.3%   2001:4118:900:cc00::119
   3044100       10147         1.3%   2001:4118:900:cc00::110
   2961000        9870         1.2%              132.66.52.85

Top-10 Possible Targets by Bytes:
                Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------------
         23.213.161.12        443                                 60442558200
         23.213.161.12                                            60442558200
         23.213.161.20        443                                 48905402100
         23.213.161.20                                            48905402100
  2001:bf8:900:d:2::71       8443                                 29596512600
  2001:bf8:900:d:2::71                                            29596512600
                                    216.58.204.234        443      5411818800
                                    216.58.204.234                 5411818800
        142.251.209.42        443                                  4690815900
        142.251.209.42                                             4690815900

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-09-26 04:43:53
End Time: ongoing

First Event Seen: 2025-09-26 04:41:00
Last Event Seen: 2025-09-26 04:42:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/214970/