Cereal2 · Observed attack

AS53107 UDP flood on 177.104.183.0/24 | 2026-10-13 19:49:33Z

· Event #328719

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T19:49:33.714Z
Recorded

Recorded 393ms after observation

Affected network
177.104.183.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000077 55 a0 1c 3c fd 81 b4wU..<...
0000000866 0c 36 fa 02 50 19 25f.6..P.%
00000010b8 fb ff c3 f7 0b df b2........
0000001814 74 6b 82 3f 38 cc f8.tk.?8..

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

bbce883cce4f20de38a2045c05216679826b48ececd192a8691ed10ebe71894b

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
7755a01c3cfd81b4660c36fa02501925b8fbffc3f70bdfb214746b823f38ccf8

Original bytes (Base64)

Nzc1NWEwMWMzY2ZkODFiNDY2MGMzNmZhMDI1MDE5MjViOGZiZmZjM2Y3MGJkZmIyMTQ3NDZiODIzZjM4Y2NmOA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.