[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #245867 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 27, 2026 12:28:22 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #245867 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 245867

Top-10 Src IPs by Packets:
    Packets   Est. Rate   % of Total           Src IP
----------------------------------------------------
  119250300      397501        32.7%    160.119.76.37
   63572700      211909        17.4%    160.119.76.35
   52723800      175746        14.4%    160.119.76.34
   50457900      168193        13.8%    160.119.76.38
   49135200      163784        13.5%    160.119.76.39
    1040400        3468         0.3%    185.242.226.9
     549600        1832         0.2%   103.246.225.75
     479700        1599         0.1%   172.237.27.147
     388800        1296         0.1%    185.91.127.85
     339000        1130         0.1%    164.52.24.180

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   218400         728         0.1%      132.70.60.22
    99000         330         0.0%      192.114.5.10
    88500         295         0.0%    192.114.91.243
    86400         288         0.0%    192.114.91.246
    73800         246         0.0%    192.114.91.245
    71700         239         0.0%   192.114.105.254
    71400         238         0.0%      132.76.61.52
    70200         234         0.0%    192.114.91.248
    68100         227         0.0%    192.114.91.247
    66000         220         0.0%    192.114.91.244

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  160.119.76.37                                     4770012000
  160.119.76.35                                     2542908000
  160.119.76.34      41702                          2108952000
  160.119.76.34                                     2108952000
  160.119.76.38      41706                          2018316000
  160.119.76.38                                     2018316000
  160.119.76.39      41713                          1965408000
  160.119.76.39                                     1965408000
  160.119.76.37      41706                          1765404000
  160.119.76.37      41687                          1697664000

Metric Info:
1015k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-27 09:24:53
End Time: ongoing

First Event Seen: 2026-04-27 09:22:00
Last Event Seen: 2026-04-27 09:26:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/245867/