[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #379168 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, July 29, 2025 6:56:17 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #379168 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 379168

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  11930100       39767        20.2%     34.55.102.107
  11112300       37041        18.8%     34.28.207.190
   8196600       27322        13.9%     35.226.27.221
   7695000       25650        13.0%      34.66.88.210
   1668000        5560         2.8%    141.148.59.116
    658500        2195         1.1%   185.191.127.222
    473400        1578         0.8%    185.91.127.107
    469200        1564         0.8%    185.224.128.23
    344700        1149         0.6%    176.65.148.215
    333000        1110         0.6%    176.65.148.173

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
    62700         209         0.1%   192.114.91.247
    58200         194         0.1%     192.114.52.5
    51900         173         0.1%   132.64.157.130
    49500         165         0.1%    132.64.157.59
    48300         161         0.1%   132.64.157.235
    48000         160         0.1%   132.64.157.221
    47400         158         0.1%    132.64.157.60
    47100         157         0.1%   132.64.157.243
    46200         154         0.1%   132.64.157.187
    45600         152         0.1%    132.64.157.30

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  34.55.102.107                                      477204000
  34.28.207.190                                      444492000
  35.226.27.221                                      327864000
   34.66.88.210                                      307800000
  34.55.102.107      40787                           148116000
  34.55.102.107      40813                           133320000
   34.66.88.210      40798                           128352000
  34.28.207.190      40885                           117396000
  34.28.207.190      40889                           112548000
  34.28.207.190      40894                           107592000

Metric Info:
237k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2025-07-29 03:51:09
End Time: ongoing

First Event Seen: 2025-07-29 03:48:00
Last Event Seen: 2025-07-29 03:54:00

Further Details:
https://primary.nemo.geant.org/alerts/details/379168/