Cereal2 · Observed attack

AS53107 UDP flood on 177.104.154.0/24 | 2026-10-13 18:59:33Z

· Event #328677

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T18:59:33.507Z
Recorded

Recorded 506ms after observation

Affected network
177.104.154.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000b5 39 3a 48 43 a0 56 93.9:HC.V.
0000000857 e9 68 44 9e 99 7f 2eW.hD....
00000010f9 6e 87 cd 46 66 90 52.n..Ff.R
00000018c2 51 c0 ea 41 e1 f8 98.Q..A...

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

4a714bff7db6621f23e3ebb35532335ce9e38ced1da069d71e590e7702e3458a

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
b5393a4843a0569357e968449e997f2ef96e87cd46669052c251c0ea41e1f898

Original bytes (Base64)

YjUzOTNhNDg0M2EwNTY5MzU3ZTk2ODQ0OWU5OTdmMmVmOTZlODdjZDQ2NjY5MDUyYzI1MWMwZWE0MWUxZjg5OA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.