[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241796 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 14, 2026 1:43:32 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241796 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241796

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  17305500       57685        25.3%     160.119.76.22
  16149000       53830        23.6%     109.205.178.8
   3386700       11289         5.0%     160.119.76.26
    931500        3105         1.4%    109.205.178.43
    486900        1623         0.7%   172.232.253.221
    484800        1616         0.7%    172.237.27.147
    429600        1432         0.6%    18.221.179.104
    417000        1390         0.6%     79.124.49.134
    353700        1179         0.5%      3.83.245.221
    279300         931         0.4%     79.124.62.122

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   299100         997         0.4%    132.73.124.194
   196500         655         0.3%     132.65.180.43
    87000         290         0.1%   128.139.225.242
    76800         256         0.1%    192.114.91.244
    74700         249         0.1%    192.114.91.247
    72000         240         0.1%    192.114.91.246
    68100         227         0.1%      132.76.61.52
    65400         218         0.1%    192.114.91.243
    65100         217         0.1%    132.64.244.186
    64500         215         0.1%    192.114.91.248

Top-10 Possible Targets by Bytes:
          Src IP   Src Port          Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------------
   109.205.178.8                                             707836800
   160.119.76.22      42996                                  692220000
   160.119.76.22                                             692220000
   109.205.178.8      42936                                  354961200
   109.205.178.8      42920                                  352875600
  52.217.114.217        443                                  287538000
  52.217.114.217                                 57496       287538000
  52.217.114.217                                             287538000
                        443   132.65.180.43                  287538000
                              132.65.180.43      57496       287538000

Metric Info:
289k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-14 10:40:20
End Time: ongoing

First Event Seen: 2026-04-14 10:37:00
Last Event Seen: 2026-04-14 10:41:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241796/