Cereal2 · Observed attack

AS53107 UDP flood on 177.104.128.0/24 | 2026-10-10 00:06:28Z

· Event #322168

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T00:06:28.218Z
Recorded

Recorded 148ms after observation

Affected network
177.104.128.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.17.15138.68.128.163167.172.93.168168.144.113.82206.189.2.8638.60.136.14038.60.199.12638.60.238.10943.157.80.2943.173.37.19794.183.235.1194.183.235.14294.183.235.15995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000004f 92 7d 84 2e 1e 1e 14O.}.....
000000081a a9 5c 5b 53 f5 b3 00..\[S...
0000001083 00 82 7b 7f c2 26 bc...{..&.
0000001837 ce 90 45 0b 9f b7 617..E...a

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

62c30ddd12531c5979f80c30507906972e616306d699619dc11fb50db675ed63

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
4f927d842e1e1e141aa95c5b53f5b3008300827b7fc226bc37ce90450b9fb761

Original bytes (Base64)

NGY5MjdkODQyZTFlMWUxNDFhYTk1YzViNTNmNWIzMDA4MzAwODI3YjdmYzIyNmJjMzdjZTkwNDUwYjlmYjc2MQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.