[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #378147 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, July 19, 2025 7:13:08 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #378147 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 378147

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  25883100       86277        39.7%          34.28.207.190
   6129900       20433         9.4%           34.66.88.210
   1500600        5002         2.3%            45.194.66.8
   1122600        3742         1.7%   2001:bf8:900:d:2::71
   1067700        3559         1.6%          54.221.164.82
   1051500        3505         1.6%             52.2.25.77
   1047000        3490         1.6%          54.210.194.93
   1037100        3457         1.6%          50.19.187.198
    930600        3102         1.4%        193.142.146.168
    781500        2605         1.2%           54.157.11.23

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total                          Dst IP
-----------------------------------------------------------------
  1122600        3742         1.7%   2001:1470:ff94:d:153:5:68:171
   228900         763         0.4%                   35.186.223.74
   190800         636         0.3%                    132.71.78.50
    97200         324         0.1%                   132.73.124.64
    25200          84         0.0%                  132.66.102.121
    21600          72         0.0%                   132.65.240.60
    21300          71         0.0%                  192.114.23.221
    20400          68         0.0%                      132.72.6.1
    19800          66         0.0%                    132.76.61.52
    17100          57         0.0%                  192.114.23.207

Top-10 Possible Targets by Bytes:
                Src IP   Src Port                          Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------------------------------
  2001:bf8:900:d:2::71       8443                                                 1672498200
  2001:bf8:900:d:2::71                                                 54866      1672498200
  2001:bf8:900:d:2::71                                                            1672498200
                             8443   2001:1470:ff94:d:153:5:68:171                 1672498200
                                    2001:1470:ff94:d:153:5:68:171      54866      1672498200
                                    2001:1470:ff94:d:153:5:68:171                 1672498200
         34.28.207.190      57874                                                 1035324000
         34.28.207.190                                                            1035324000
        142.250.186.46         80                                                  276621600
        142.250.186.46                                                 51230       276621600

Metric Info:
169k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2025-07-19 04:07:50
End Time: ongoing

First Event Seen: 2025-07-19 04:05:00
Last Event Seen: 2025-07-19 04:11:00

Further Details:
https://primary.nemo.geant.org/alerts/details/378147/