[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #241991 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, April 15, 2026 1:52:00 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #241991 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 241991

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  85207200      284024        27.0%     160.119.76.19
  74027700      246759        23.5%     160.119.76.16
  45204300      150681        14.3%     160.119.76.23
  33968100      113227        10.8%     160.119.76.29
  23273400       77578         7.4%     160.119.76.18
  23157000       77190         7.3%     160.119.76.27
    645000        2150         0.2%      23.32.239.50
    626400        2088         0.2%        45.205.1.8
    579900        1933         0.2%    204.76.203.215
    535800        1786         0.2%   172.232.253.221

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
   651000        2170         0.2%   132.73.124.132
   533100        1777         0.2%     192.114.5.10
   374400        1248         0.1%   132.73.124.194
   114900         383         0.0%   192.114.91.248
    94200         314         0.0%     132.76.61.54
    87600         292         0.0%   192.114.91.244
    82500         275         0.0%   192.114.91.245
    73800         246         0.0%   192.114.91.246
    66900         223         0.0%   192.114.91.243
    63600         212         0.0%   192.114.91.249

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  160.119.76.19                                     3408288000
  160.119.76.16                                     2961108000
  160.119.76.19      49897                          1957272000
  160.119.76.23      49907                          1808172000
  160.119.76.23                                     1808172000
  160.119.76.16      49935                          1790868000
  160.119.76.19      49937                          1451016000
  160.119.76.29      49938                          1358724000
  160.119.76.29                                     1358724000
  160.119.76.16      49989                          1170240000

Metric Info:
1M SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-15 10:48:30
End Time: ongoing

First Event Seen: 2026-04-15 10:46:00
Last Event Seen: 2026-04-15 10:50:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/241991/