Cereal2 · Observed attack

AS262594 UDP flood on 177.84.246.0/23 | 2026-10-12 23:57:07Z

· Event #327799

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-12T23:57:07.375Z
Recorded

Recorded 494ms after observation

Affected network
177.84.246.0/23
Network operator
4iNET CommunicationsAS262594
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154139.59.33.238157.230.127.22159.223.68.251164.90.186.13178.128.223.9243.136.129.13143.153.106.22943.156.101.22843.157.198.13743.173.37.5382.157.209.4194.183.235.1194.183.235.14295.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000bd c4 62 3f a2 14 23 21..b?..#!
0000000825 9e 29 20 38 49 95 05%.) 8I..
000000100e a3 77 f4 5a d8 d1 60..w.Z..`
00000018b6 fb 38 0d 33 36 cf a9..8.36..

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

a9d0d05a9e60144bafb8dff79aa6c877150e68f95659df8750e02891f8c320c9

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
bdc4623fa2142321259e2920384995050ea377f45ad8d160b6fb380d3336cfa9

Original bytes (Base64)

YmRjNDYyM2ZhMjE0MjMyMTI1OWUyOTIwMzg0OTk1MDUwZWEzNzdmNDVhZDhkMTYwYjZmYjM4MGQzMzM2Y2ZhOQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.