Cereal2 · Network

Attacks observed on Cloudflare, Inc. (AS13335)

Cereal2 attack observations affecting AS13335 Cloudflare, Inc.: targeted prefixes, attack methods, destination ports, and timing over the last 30 days.

176 observations · Last 30 days · Latest observation 2026-09-30 05:39:34 UTC

Most affected countries

Hong Kong115
United States31
Australia8
France6
United Kingdom6
Canada3
Ireland3
Brazil2

Most observed methods

Nonblocking TCP connection and session-pool flood110
UDP flood with large datagrams (default 1400-byte payload)28
TCP connection and session-pool flood variant 117
UDP flood with minimal datagrams (default 1-byte payload)8
Configurable custom-payload UDP flood5
Small randomized UDP datagram flood3
Stateful TCP connection and session flood1
RakNet unconnected-ping flood1

Recent observations

2026-09-30 05:39:34 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-30 01:51:19 UTCTCP connection and session-pool flood variant 1222.167.34.48/32TCP/4431mHong Kong
2026-09-29 20:44:55 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 20:40:10 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 20:25:56 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 20:11:40 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 20:06:55 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 20:00:35 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 16:47:09 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 16:40:55 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 16:07:23 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 16:00:26 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 15:50:19 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/301201mUnited States
2026-09-29 15:48:14 UTCStateful TCP connection and session flood172.65.190.166/32TCP/301201mUnited States
2026-09-29 15:46:05 UTCRakNet unconnected-ping flood172.65.190.166/32UDP/301201mUnited States
2026-09-29 10:33:10 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180041mHong Kong
2026-09-29 10:30:07 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180041mHong Kong
2026-09-29 09:42:18 UTCHigh-concurrency TCP connection-pool flood222.167.34.48/32TCP/801mHong Kong
2026-09-29 05:43:37 UTCUDP flood with large datagrams (default 1400-byte payload)104.29.155.253/32UDP/193391mFrance
2026-09-29 05:38:33 UTCUDP flood with large datagrams (default 1400-byte payload)104.29.148.5/32UDP/193411mFrance
2026-09-29 05:33:47 UTCUDP flood with large datagrams (default 1400-byte payload)104.29.148.19/32UDP/193411mFrance
2026-09-29 05:28:12 UTCUDP flood with large datagrams (default 1400-byte payload)104.29.155.255/32UDP/193131mFrance
2026-09-28 17:41:27 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180041mHong Kong
2026-09-28 17:39:05 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180041mHong Kong
2026-09-28 17:36:57 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180041mHong Kong
2026-09-28 17:34:51 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180041mHong Kong
2026-09-28 17:32:01 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180041mHong Kong
2026-09-28 11:49:32 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180031mHong Kong
2026-09-27 06:19:59 UTCUDP flood with large datagrams (default 1400-byte payload)104.29.157.252/32UDP/193061mUnited States
2026-09-26 04:51:06 UTCTCP connection and session-pool flood variant 123.227.38.74/32TCP/4431mCanada
2026-09-26 02:52:25 UTCTCP connection and session-pool flood variant 123.227.38.74/32TCP/4431mCanada
2026-09-26 02:32:05 UTCTCP connection and session-pool flood variant 123.227.38.74/32TCP/801mCanada
2026-09-21 17:01:53 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180031mHong Kong
2026-09-21 16:57:47 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180031mHong Kong
2026-09-21 16:33:04 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180031mHong Kong
2026-09-21 16:22:50 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180031mHong Kong
2026-09-21 16:18:41 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180031mHong Kong
2026-09-21 16:15:36 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180031mHong Kong
2026-09-21 16:12:31 UTCNonblocking TCP connection and session-pool flood222.167.34.222/32TCP/180031mHong Kong
2026-09-21 11:24:49 UTCTCP connection and session-pool flood variant 1172.65.190.166/32TCP/270401mUnited States

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.