[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #243230 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, April 19, 2026 9:51:07 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #243230 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 243230

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  70913700      236379        22.5%     160.119.76.19
  70301100      234337        22.3%     160.119.76.22
  69620400      232068        22.1%     160.119.76.28
  39021300      130071        12.4%     160.119.76.29
  38017500      126725        12.1%     160.119.76.23
    522600        1742         0.2%      45.79.123.76
    453600        1512         0.1%   172.232.253.221
    366900        1223         0.1%     164.52.24.184
    365700        1219         0.1%     164.52.24.180
    289200         964         0.1%      207.90.244.5

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   163800         546         0.1%    132.73.124.194
   138000         460         0.0%      192.114.5.10
   101400         338         0.0%      132.76.61.52
    94200         314         0.0%      132.76.61.54
    68100         227         0.0%      132.76.61.51
    65400         218         0.0%      132.76.61.53
    56700         189         0.0%   192.114.105.254
    48900         163         0.0%    192.114.91.246
    45900         153         0.0%    192.114.91.244
    43800         146         0.0%       132.70.66.9

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  160.119.76.19                                     2836548000
  160.119.76.22                                     2812044000
  160.119.76.28                                     2784816000
  160.119.76.28      41106                          1783140000
  160.119.76.29      41083                          1560852000
  160.119.76.29                                     1560852000
  160.119.76.22      41011                          1529556000
  160.119.76.23      41106                          1520700000
  160.119.76.23                                     1520700000
  160.119.76.19      41097                          1465440000

Metric Info:
1M SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-19 06:47:59
End Time: ongoing

First Event Seen: 2026-04-19 06:45:00
Last Event Seen: 2026-04-19 06:49:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/243230/