[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #379359 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, July 30, 2025 3:24:59 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #379359 CRIT: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 379359

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  9854100       32847        20.7%     34.28.207.190
  5344500       17815        11.2%     34.136.232.55
  5155500       17185        10.8%     35.226.27.221
  4942800       16476        10.4%     34.55.102.107
  1236000        4120         2.6%    141.148.59.116
   769500        2565         1.6%   185.191.127.222
   506400        1688         1.1%     196.251.91.93
   450900        1503         0.9%    185.91.127.107
   345000        1150         0.7%    176.65.148.173
   332400        1108         0.7%     176.65.150.47

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   113700         379         0.2%      132.70.66.13
    80100         267         0.2%   192.114.105.254
    69000         230         0.1%     132.76.20.115
    64800         216         0.1%       132.76.20.1
    64500         215         0.1%      132.76.20.24
    63300         211         0.1%     132.76.20.204
    62700         209         0.1%      132.76.20.97
    60600         202         0.1%      132.76.20.16
    59400         198         0.1%    132.73.124.193
    54900         183         0.1%     34.28.207.190

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  34.28.207.190                                      394164000
  34.136.232.55                                      213780000
  35.226.27.221                                      206220000
  34.28.207.190      57775                           202536000
  34.55.102.107                                      197712000
  35.226.27.221      57778                           105480000
  35.226.27.221      57788                           100740000
  34.28.207.190      57780                           100572000
  34.28.207.190      57795                            91056000
  34.136.232.55      57766                            78360000

Metric Info:
218k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2025-07-30 12:19:47
End Time: ongoing

First Event Seen: 2025-07-30 12:17:00
Last Event Seen: 2025-07-30 12:23:00

Further Details:
https://primary.nemo.geant.org/alerts/details/379359/