[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377456 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 11, 2025 1:38:07 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377456 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377456

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  74451900      248173        22.8%      85.17.90.43
  54755100      182517        16.7%     31.172.80.90
  43446000      144820        13.3%     43.250.53.25
  29681400       98938         9.1%     5.39.217.109
  28419900       94733         8.7%   185.244.128.79
  17933100       59777         5.5%    185.204.52.33
  17689500       58965         5.4%    84.238.133.19
  16572600       55242         5.1%    84.238.133.38
  14115000       47050         4.3%   195.160.220.89
   7162200       23874         2.2%     91.92.144.79

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
    75600         252         0.0%    192.114.3.125
    75000         250         0.0%    192.114.3.139
    71700         239         0.0%   192.114.58.219
    71400         238         0.0%   192.114.58.112
    69600         232         0.0%    192.114.3.252
    69300         231         0.0%   192.114.58.134
    69300         231         0.0%   192.114.58.138
    69300         231         0.0%   192.114.58.247
    69300         231         0.0%   192.114.60.209
    68400         228         0.0%    192.114.58.33

Top-10 Possible Targets by Bytes:
          Src IP   Src Port   Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------
     85.17.90.43                                     3275883600
    31.172.80.90                                     2409224400
    43.250.53.25                                     1911624000
    5.39.217.109                                     1305981600
  185.244.128.79                                     1250475600
   185.204.52.33                                      789056400
   84.238.133.19                                      778342800
   84.238.133.38                                      729194400
  195.160.220.89                                      621060000
    5.39.217.109      46571                           369547200

Metric Info:
2M SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2025-07-10 22:32:54
End Time: ongoing

First Event Seen: 2025-07-10 22:30:00
Last Event Seen: 2025-07-10 22:36:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377456/