[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377494 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Friday, July 11, 2025 11:03:08 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377494 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377494

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  24459900       81533        52.5%     89.248.163.61
    980100        3267         2.1%   148.153.188.254
    681900        2273         1.5%   185.191.127.222
    611400        2038         1.3%     104.156.155.4
    587400        1958         1.3%     89.42.231.140
    577800        1926         1.2%     149.86.227.49
    515400        1718         1.1%    204.76.203.206
    468600        1562         1.0%     89.248.163.67
    324300        1081         0.7%    193.34.212.110
    307200        1024         0.7%       45.194.66.8

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
    47100         157         0.1%   128.139.225.244
    42300         141         0.1%   192.114.105.254
    28800          96         0.1%      132.70.66.12
    23100          77         0.0%     132.65.240.60
    19500          65         0.0%    132.73.124.193
    19200          64         0.0%     128.139.199.3
    18900          63         0.0%      192.114.5.10
    16500          55         0.0%     132.74.74.134
    15000          50         0.0%    208.67.222.222
    13500          45         0.0%      132.76.61.52

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
    89.248.163.61                                              1271914800
  148.153.188.254                                    9101        50965200
  148.153.188.254                                                50965200
                         443   192.114.105.254                   32654400
                               192.114.105.254                   32654400
   159.124.45.208        443                                     29058000
   159.124.45.208                                   10478        29058000
   159.124.45.208                                                29058000
                               192.114.105.254      10478        29058000
  185.191.127.222                                                27276000

Metric Info:
240k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2025-07-11 07:57:54
End Time: ongoing

First Event Seen: 2025-07-11 07:55:00
Last Event Seen: 2025-07-11 08:01:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377494/