[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #426549 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, June 29, 2026 1:46:39 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #426549 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 426549

Top-10 Src IPs by Packets:
  Packets   Est. Rate   % of Total           Src IP
--------------------------------------------------
  1207500        4025         2.2%     5.255.99.247
  1058400        3528         1.9%    52.23.253.237
  1043100        3477         1.9%      3.86.139.26
  1035300        3451         1.9%     54.87.47.161
   968400        3228         1.7%     146.112.41.2
   805500        2685         1.4%   100.58.175.151
   802500        2675         1.4%   44.204.234.247
   799200        2664         1.4%   54.173.136.148
   798600        2662         1.4%      3.82.143.23
   795300        2651         1.4%   100.53.186.157

Top-10 Dst IPs by Packets:
  Packets   Est. Rate   % of Total            Dst IP
---------------------------------------------------
   260100         867         0.5%    192.114.91.244
   257700         859         0.5%    192.114.91.247
   253200         844         0.5%    192.114.91.243
   250800         836         0.5%    192.114.91.245
   247800         826         0.4%    192.114.91.248
   241500         805         0.4%    192.114.91.246
   225900         753         0.4%    192.114.91.249
   207600         692         0.4%   192.114.105.254
   150000         500         0.3%    132.66.233.125
    86400         288         0.2%   128.139.225.242

Top-10 Possible Targets by Bytes:
           Src IP   Src Port           Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
    104.18.11.200        443                                   220972800
    104.18.11.200                                  13783       220972800
    104.18.11.200                                              220972800
                         443   132.66.233.125                  220972800
                               132.66.233.125      13783       220972800
                               132.66.233.125                  220972800
    52.23.253.237                                     21        63504000
    52.23.253.237                                               63504000
  151.101.242.172         80                                    63198000
  151.101.242.172                                               63198000

Metric Info:
504k SYN Packets/s

Alert Type:
time_window

Alert Description:
High SYN packet rate

Start Time: 2026-06-29 10:42:30
End Time: ongoing

First Event Seen: 2026-06-29 10:40:00
Last Event Seen: 2026-06-29 10:45:00

Further Details:
https://primary.nemo.geant.org/alerts/details/426549/