[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241595 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 13, 2026 3:06:29 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241595 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241595

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  69450000      231500        22.7%    160.119.76.28
  41857200      139524        13.7%    160.119.76.23
  38089500      126965        12.5%    160.119.76.22
  35961600      119872        11.8%    160.119.76.19
  33167400      110558        10.9%    160.119.76.29
  29011500       96705         9.5%    160.119.76.25
  24942000       83140         8.2%    160.119.76.27
   1512900        5043         0.5%   193.124.20.242
   1432800        4776         0.5%      64.52.19.66
    912300        3041         0.3%     64.52.19.196

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
   304200        1014         0.1%   132.73.124.194
   174000         580         0.1%   192.114.91.245
   112500         375         0.0%      132.70.66.9
    85800         286         0.0%   192.114.91.249
    75000         250         0.0%     132.70.66.12
    67800         226         0.0%   192.114.91.246
    66000         220         0.0%   192.114.91.243
    64200         214         0.0%     132.76.61.52
    62100         207         0.0%     192.114.52.4
    59400         198         0.0%     132.70.66.10

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  160.119.76.28                                     2778000000
  160.119.76.23      41611                          1674288000
  160.119.76.23                                     1674288000
  160.119.76.22      41550                          1523580000
  160.119.76.22                                     1523580000
  160.119.76.28      41636                          1473708000
  160.119.76.19      41608                          1438464000
  160.119.76.19                                     1438464000
  160.119.76.29      41588                          1326696000
  160.119.76.29                                     1326696000

Metric Info:
1M SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-13 12:02:53
End Time: ongoing

First Event Seen: 2026-04-13 12:00:00
Last Event Seen: 2026-04-13 12:04:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241595/