[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #425955 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Wednesday, June 24, 2026 9:26:38 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #425955 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 425955

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
   809400        2698         3.0%     5.255.99.247
   599400        1998         2.2%     72.167.37.35
   515400        1718         1.9%     146.112.41.2
   483000        1610         1.8%     3.142.170.60
   481800        1606         1.8%     18.190.15.50
   480300        1601         1.8%   18.221.179.104
   460200        1534         1.7%      3.131.24.55
   452700        1509         1.7%    18.119.209.50
   432000        1440         1.6%    194.180.49.70
   420600        1402         1.5%   35.169.206.177

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   207900         693         0.8%    132.75.176.230
   146700         489         0.5%    192.114.91.247
   134100         447         0.5%    192.114.91.244
   121500         405         0.4%    192.114.91.243
   107400         358         0.4%    192.114.91.246
   101400         338         0.4%    192.114.91.245
    95100         317         0.3%    192.114.91.248
    84900         283         0.3%    192.114.91.249
    79800         266         0.3%      132.70.66.14
    73800         246         0.3%   192.114.105.254

Top-10 Possible Targets by Bytes:
          Src IP   Src Port           Dst IP   Dst Port   Sampled Count
---------------------------------------------------------------------
  23.218.225.112                                              295180800
  23.218.225.112        443                                   295165200
  23.218.225.112                                  10400       295134000
                        443   132.75.176.230                  295116000
                              132.75.176.230      10400       295116000
                              132.75.176.230                  295116000
                                132.70.66.14                   91309800
                        443     132.70.66.14                   91258200
  138.199.37.231        443                                    91137000
  138.199.37.231                                  10402        91137000

Metric Info:
197k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2026-06-24 06:23:22
End Time: ongoing

First Event Seen: 2026-06-24 06:21:00
Last Event Seen: 2026-06-24 06:25:00

Further Details:
https://primary.nemo.geant.org/alerts/details/425955/