[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #377853 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 15, 2025 1:42:03 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #377853 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 377853

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  16136400       53788        31.8%     34.55.102.107
   4064400       13548         8.0%      34.66.88.210
   3503400       11678         6.9%     35.226.27.221
   2105700        7019         4.1%     34.28.207.190
    948300        3161         1.9%     185.242.226.5
    740400        2468         1.5%   185.191.127.222
    509400        1698         1.0%     18.117.57.162
    502800        1676         1.0%    18.217.194.148
    497700        1659         1.0%        52.14.58.0
    487500        1625         1.0%      3.136.67.107

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   319200        1064         0.6%    132.68.141.102
   165600         552         0.3%      132.71.97.55
   157800         526         0.3%      132.66.62.20
   129000         430         0.3%    132.66.206.127
    75300         251         0.1%   192.114.105.254
    71400         238         0.1%      132.70.66.11
    65100         217         0.1%   128.139.225.244
    55200         184         0.1%    132.73.124.193
    52200         174         0.1%       132.70.66.9
    51300         171         0.1%        132.74.3.2

Top-10 Possible Targets by Bytes:
         Src IP   Src Port         Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------
  34.55.102.107                                            645456000
  34.55.102.107      55605                                 325980000
  52.98.206.242        443                                 231855000
  52.98.206.242                                            231855000
  52.98.206.242                                53951       231785400
                       443   132.66.62.20                  231785400
                             132.66.62.20      53951       231785400
                             132.66.62.20                  231785400
   23.50.151.36        443                                 192704100
   23.50.151.36                                54161       192704100

Metric Info:
181k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2025-07-15 10:36:59
End Time: ongoing

First Event Seen: 2025-07-15 10:34:00
Last Event Seen: 2025-07-15 10:40:00

Further Details:
https://primary.nemo.geant.org/alerts/details/377853/