Cereal2 · Observed attack

AS53107 UDP flood on 177.104.149.0/24 | 2026-10-10 00:32:23Z

· Event #322252

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T00:32:23.628Z
Recorded

Recorded 152ms after observation

Affected network
177.104.149.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.77.120

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000078 e1 c4 4a 08 b7 0c d0x..J....
00000008ef 3f b7 11 0a e2 de d7.?......
0000001059 19 c2 7f d3 e1 e4 9eY.......
00000018d4 6e 64 53 4c 2d a4 e4.ndSL-..

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

bf7885b71199118dcacc7e8ba97543cd8cff96f83ee3e9c88b29aecfd561bacd

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
78e1c44a08b70cd0ef3fb7110ae2ded75919c27fd3e1e49ed46e64534c2da4e4

Original bytes (Base64)

NzhlMWM0NGEwOGI3MGNkMGVmM2ZiNzExMGFlMmRlZDc1OTE5YzI3ZmQzZTFlNDllZDQ2ZTY0NTM0YzJkYTRlNA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.