[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242023 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, April 15, 2026 3:28:56 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242023 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242023

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total            Src IP
-----------------------------------------------------
  107337900      357793        35.4%     160.119.76.32
   66230400      220768        21.9%     160.119.76.36
   48885300      162951        16.1%     160.119.76.30
   38005500      126685        12.5%     160.119.76.38
     705300        2351         0.2%    185.132.53.198
     591300        1971         0.2%      45.79.123.76
     491700        1639         0.2%    34.228.104.231
     478500        1595         0.2%    172.237.27.147
     471600        1572         0.2%    35.169.206.177
     435900        1453         0.1%   172.232.253.221

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total           Dst IP
--------------------------------------------------
   300600        1002         0.1%   132.73.124.194
   114000         380         0.0%   132.64.102.204
    91800         306         0.0%    132.65.180.37
    74400         248         0.0%    132.68.39.162
    72600         242         0.0%   192.114.91.249
    72600         242         0.0%     132.70.66.10
    69900         233         0.0%   192.114.91.245
    69600         232         0.0%     132.76.61.52
    61800         206         0.0%   192.114.91.248
    61800         206         0.0%   132.73.124.145

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  160.119.76.32                                     4293516000
  160.119.76.36                                     2649216000
  160.119.76.30                                     1955412000
  160.119.76.32      55770                          1808580000
  160.119.76.36      55769                          1523628000
  160.119.76.38      55772                          1520220000
  160.119.76.38                                     1520220000
  160.119.76.32      55795                          1416468000
  160.119.76.36      55825                          1125588000
  160.119.76.30      55758                          1116732000

Metric Info:
1M SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-15 12:25:30
End Time: ongoing

First Event Seen: 2026-04-15 12:23:00
Last Event Seen: 2026-04-15 12:27:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242023/