[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377273 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, July 9, 2025 12:01:05 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377273 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377273

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  12068700       40229        26.5%     34.55.102.107
   6466500       21555        14.2%      34.66.88.210
   4725900       15753        10.4%     34.28.207.190
   3045300       10151         6.7%     35.226.27.221
    713400        2378         1.6%   185.191.127.222
    574800        1916         1.3%     89.42.231.140
    479400        1598         1.1%     89.248.163.67
    343200        1144         0.8%     149.86.227.49
    324300        1081         0.7%       45.194.66.8
    297900         993         0.7%    15.235.227.163

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   126300         421         0.3%      192.114.52.1
    46500         155         0.1%   128.139.225.244
    46200         154         0.1%     192.114.52.11
    36600         122         0.1%    192.114.23.221
    28500          95         0.1%     132.65.240.60
    20700          69         0.0%      132.76.61.52
    19500          65         0.0%        132.72.6.1
    18600          62         0.0%      192.114.5.10
    18000          60         0.0%      132.76.61.53
    17400          58         0.0%     34.104.35.123

Top-10 Possible Targets by Bytes:
         Src IP   Src Port         Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
  34.55.102.107                                            482748000
   34.66.88.210                                            258660000
  34.28.207.190                                            189036000
                             192.114.52.1                  175971600
  23.246.51.136        443                                 175938000
  23.246.51.136                                54895       175938000
  23.246.51.136                                            175938000
                       443   192.114.52.1                  175938000
                             192.114.52.1      54895       175938000
  35.226.27.221      47955                                 121812000

Metric Info:
174k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2025-07-08 20:55:54
End Time: ongoing

First Event Seen: 2025-07-08 20:53:00
Last Event Seen: 2025-07-08 20:59:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377273/