[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #242300 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Thursday, April 16, 2026 1:23:38 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #242300 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 242300

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  95211600      317372        12.9%   160.119.76.38
  82742700      275809        11.2%   160.119.76.34
  76003200      253344        10.3%   160.119.76.36
  56182800      187276         7.6%   160.119.76.16
  53680500      178935         7.3%   160.119.76.28
  49179300      163931         6.7%   160.119.76.27
  48993000      163310         6.7%   160.119.76.32
  48535500      161785         6.6%   160.119.76.19
  46441500      154805         6.3%   160.119.76.22
  41012700      136709         5.6%   160.119.76.30

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total                                 Dst IP
------------------------------------------------------------------------
   236400         788         0.0%                         132.73.124.194
   190800         636         0.0%                          192.114.3.241
    96000         320         0.0%                         192.114.23.221
    91500         305         0.0%                            132.70.66.9
    90000         300         0.0%                          132.64.168.19
    63300         211         0.0%                         132.73.124.145
    60600         202         0.0%   2001:bf8:200:391:68ea:2f24:10ef:201b
    57000         190         0.0%                         192.114.91.248
    53400         178         0.0%                         192.114.91.246
    53100         177         0.0%                           132.70.66.14

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  160.119.76.38                                     3808464000
  160.119.76.34                                     3309708000
  160.119.76.36                                     3040128000
  160.119.76.16      54645                          2247312000
  160.119.76.16                                     2247312000
  160.119.76.28      54661                          2147220000
  160.119.76.28                                     2147220000
  160.119.76.38      54679                          2096400000
  160.119.76.27      54666                          1967172000
  160.119.76.27                                     1967172000

Metric Info:
3M SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-16 10:20:01
End Time: ongoing

First Event Seen: 2026-04-16 10:17:00
Last Event Seen: 2026-04-16 10:21:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/242300/