[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #254737 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, July 6, 2026 4:53:01 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #254737 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 254737

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  41033700      136779        51.1%      82.147.85.62
   1214700        4049         1.5%      5.255.99.247
    922200        3074         1.1%     194.180.49.71
    848400        2828         1.1%    194.180.49.216
    804600        2682         1.0%     194.180.49.70
    794700        2649         1.0%    194.180.49.218
    778500        2595         1.0%    194.180.49.217
    511800        1706         0.6%       5.187.35.26
    482400        1608         0.6%   172.232.253.221
    462300        1541         0.6%      146.112.41.2

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total                                 Dst IP
------------------------------------------------------------------------
   154800         516         0.2%                          132.69.221.35
   141300         471         0.2%                        192.114.105.254
    87600         292         0.1%   2001:bf8:200:395:d54f:e3fe:35fb:69ca
    69900         233         0.1%                          104.20.28.246
    65700         219         0.1%                         192.114.23.221
    64500         215         0.1%                          192.114.88.52
    63300         211         0.1%                          192.114.88.59
    56100         187         0.1%                          192.114.88.56
    55800         186         0.1%                          192.114.88.54
    52200         174         0.1%                          192.114.88.60

Top-10 Possible Targets by Bytes:
         Src IP   Src Port                                 Dst IP   Dst Port   Sampled Count
------------------------------------------------------------------------------------------
   82.147.85.62                                                                   1641348000
   82.147.85.62      45561                                                        1093488000
   82.147.85.62      45676                                                         441180000
  74.125.71.207        443                                                         218249700
  74.125.71.207                                                        59161       218249700
  74.125.71.207                                                                    218249700
                       443                          132.69.221.35                  218249700
                                                    132.69.221.35      59161       218249700
                                                    132.69.221.35                  218249700
                        80   2001:bf8:200:395:d54f:e3fe:35fb:69ca                  113806200

Metric Info:
401k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-07-06 13:49:51
End Time: ongoing

First Event Seen: 2026-07-06 13:47:00
Last Event Seen: 2026-07-06 13:51:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/254737/