Cereal2 · Observed attack

AS53107 UDP flood on 177.136.232.0/23 | 2026-10-13 20:21:33Z

· Event #328761

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T20:21:33.912Z
Recorded

Recorded 148ms after observation

Affected network
177.136.232.0/23
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000098 6b 6e 75 74 3d 4d a9.knut=M.
00000008d5 7d 20 bc 77 7e c1 16.} .w~..
0000001028 42 95 a0 dc 92 18 25(B.....%
0000001845 8c bb 13 08 bf 67 9cE.....g.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

0410698d959fdfd952191a3f581c7bb09a58fc8367b0c63467485a8a6a8eef1f

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
986b6e75743d4da9d57d20bc777ec116284295a0dc921825458cbb1308bf679c

Original bytes (Base64)

OTg2YjZlNzU3NDNkNGRhOWQ1N2QyMGJjNzc3ZWMxMTYyODQyOTVhMGRjOTIxODI1NDU4Y2JiMTMwOGJmNjc5Yw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.