[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241797 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 14, 2026 1:58:46 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241797 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241797

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  107702700      359009        24.7%     160.119.76.28
   98762400      329208        22.7%     160.119.76.16
   89690400      298968        20.6%     160.119.76.18
   57208500      190695        13.1%     160.119.76.27
   50366100      167887        11.6%     160.119.76.29
     963600        3212         0.2%    148.153.56.174
     580500        1935         0.1%    204.76.203.215
     579000        1930         0.1%        45.205.1.8
     487500        1625         0.1%   172.232.253.221
     465300        1551         0.1%   185.242.226.120

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   346200        1154         0.1%    132.73.124.194
   106500         355         0.0%     192.114.52.10
   104700         349         0.0%      132.70.66.11
    96600         322         0.0%     132.65.180.32
    88200         294         0.0%      132.66.42.54
    83700         279         0.0%      132.70.66.14
    83400         278         0.0%    192.114.91.245
    72900         243         0.0%      132.76.61.51
    72600         242         0.0%      132.76.61.52
    70500         235         0.0%   128.139.225.242

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  160.119.76.28                                     4308108000
  160.119.76.16                                     3950496000
  160.119.76.18                                     3587616000
  160.119.76.16      43944                          2382060000
  160.119.76.27      43965                          2288340000
  160.119.76.27                                     2288340000
  160.119.76.28      43957                          2215884000
  160.119.76.28      43968                          2092224000
  160.119.76.29      43907                          2014644000
  160.119.76.29                                     2014644000

Metric Info:
1009k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-14 10:55:27
End Time: ongoing

First Event Seen: 2026-04-14 10:52:00
Last Event Seen: 2026-04-14 10:56:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241797/