[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #251305 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, June 9, 2026 9:09:42 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #251305 CRIT: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 251305

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total            Src IP
---------------------------------------------------
  6110400       20368         6.2%   144.126.227.167
  6002700       20009         6.1%     138.68.131.11
  5677500       18925         5.8%   144.126.226.237
  4986300       16621         5.1%    104.255.152.19
  4939200       16464         5.0%    104.255.152.29
  4929300       16431         5.0%    199.167.138.45
  4929000       16430         5.0%    199.21.149.124
  4889400       16298         5.0%    104.255.152.18
  4291500       14305         4.3%     108.181.3.205
  4267800       14226         4.3%     108.181.23.83

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   131100         437         0.1%      192.114.0.68
    37500         125         0.0%      132.76.61.53
    16200          54         0.0%    192.114.23.221
    10500          35         0.0%   128.139.225.242
     9600          32         0.0%      132.66.11.65
     9000          30         0.0%      132.76.61.54
     7800          26         0.0%     192.114.3.241
     7500          25         0.0%     132.65.240.60
     6300          21         0.0%      132.76.61.52
     5400          18         0.0%     132.78.37.111

Top-10 Possible Targets by Bytes:
           Src IP   Src Port   Dst IP   Dst Port   Sampled Count
--------------------------------------------------------------
  144.126.227.167      52810                           244416000
  144.126.227.167                                      244416000
    138.68.131.11      52909                           240108000
    138.68.131.11                                      240108000
  144.126.226.237      52867                           227100000
  144.126.226.237                                      227100000
   104.255.152.19      49744                           199452000
   104.255.152.19                                      199452000
   104.255.152.29                                      197568000
   199.167.138.45      49762                           197172000

Metric Info:
619k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate.

Start Time: 2026-06-09 03:46:13
End Time: ongoing

First Event Seen: 2026-06-09 03:44:00
Last Event Seen: 2026-06-09 06:08:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/251305/