[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #379064 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, July 28, 2025 4:21:16 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #379064 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 379064

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  114705300      382351        59.4%    89.248.163.224
   58247400      194158        30.2%    89.248.163.213
    1322100        4407         0.7%    141.148.59.116
    1002300        3341         0.5%    66.240.236.116
     659700        2199         0.3%   185.191.127.222
     624600        2082         0.3%    185.91.127.107
     507600        1692         0.3%     176.65.149.64
     504300        1681         0.3%     176.65.149.67
     476400        1588         0.2%    176.65.148.226
     435900        1453         0.2%   213.238.175.111

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total                 Dst IP
--------------------------------------------------------
   216600         722         0.1%        142.250.180.138
    83100         277         0.0%   2001:bf8:900:d:2::71
    56700         189         0.0%         132.64.135.248
    56100         187         0.0%         132.64.135.124
    55800         186         0.0%          132.64.135.62
    54600         182         0.0%          132.64.135.47
    54600         182         0.0%         132.64.135.218
    52800         176         0.0%         132.64.135.228
    50700         169         0.0%          132.64.135.18
    50700         169         0.0%         132.64.135.169

Top-10 Possible Targets by Bytes:
          Src IP   Src Port   Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------
  89.248.163.224                                     4588212000
  89.248.163.213      45228                          2329896000
  89.248.163.213                                     2329896000
  89.248.163.224      45173                          2078976000
  89.248.163.224      45298                          2050932000
  89.248.163.224      45058                           457020000
  141.148.59.116                                       68749200
  66.240.236.116                             21        52119600
  66.240.236.116                                       52119600
    16.15.178.41        443                            32875200

Metric Info:
832k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2025-07-28 01:16:02
End Time: ongoing

First Event Seen: 2025-07-28 01:13:00
Last Event Seen: 2025-07-28 01:19:00

Further Details:
https://primary.nemo.geant.org/alerts/details/379064/