[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #246089 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 28, 2026 10:24:25 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #246089 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 246089

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total          Src IP
--------------------------------------------------
  97218000      324060        21.8%   160.119.76.32
  91461300      304871        20.5%   160.119.76.35
  52326300      174421        11.7%   160.119.76.36
  44279700      147599         9.9%   160.119.76.37
  38879700      129599         8.7%   160.119.76.31
  37863300      126211         8.5%   160.119.76.51
  33335100      111117         7.5%   160.119.76.38
  11110800       37036         2.5%   160.119.76.55
   9160500       30535         2.1%     80.94.92.11
   3008100       10027         0.7%    45.142.193.6

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   392700        1309         0.1%    132.76.220.144
    88200         294         0.0%   192.114.105.254
    80100         267         0.0%    192.114.91.248
    69000         230         0.0%      132.76.61.51
    66600         222         0.0%    192.114.91.245
    65100         217         0.0%    192.114.91.244
    61800         206         0.0%      132.76.61.52
    60600         202         0.0%    192.114.91.249
    57900         193         0.0%    192.114.91.246
    57900         193         0.0%    192.114.91.247

Top-10 Possible Targets by Bytes:
         Src IP   Src Port   Dst IP   Dst Port   Sampled Count
------------------------------------------------------------
  160.119.76.32                                     3888720000
  160.119.76.35                                     3658452000
  160.119.76.36      40677                          2093052000
  160.119.76.36                                     2093052000
  160.119.76.32      40660                          1966428000
  160.119.76.35      40643                          1924848000
  160.119.76.32      40671                          1922292000
  160.119.76.37      40666                          1769832000
  160.119.76.37                                     1769832000
  160.119.76.35      40693                          1733604000

Metric Info:
956k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-04-28 07:20:54
End Time: ongoing

First Event Seen: 2026-04-28 07:18:00
Last Event Seen: 2026-04-28 07:22:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/246089/