Cereal2 · Observed attack

AS263601 UDP flood on 177.10.172.0/24 | 2026-10-10 04:45:26Z

· Event #322978

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T04:45:26.190Z
Recorded

Recorded 139ms after observation

Affected network
177.10.172.0/24
Network operator
Anderson Marcos Coelho e Cia Ltda - MEAS263601
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.107.174130.94.16.10130.94.17.15130.94.32.14134.122.68.238137.184.100.23138.68.128.163157.230.254.212157.245.188.54167.172.93.168168.144.113.82206.189.2.86209.38.240.4438.60.136.14038.60.199.12638.60.238.10943.157.80.2943.166.73.11243.173.37.19747.237.95.14947.85.194.7994.183.235.1194.183.235.14294.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000009 47 3a 3c 90 b8 0e 73.G:<...s
00000008ff 9f 1b 4c 77 5a 9b b8...LwZ..
00000010e2 bd be 56 da 66 97 1d...V.f..
00000018b8 a7 8e bd 20 b9 8b b1.... ...

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

8c3497195491808e963cfe5913841ae2c0b14644869c8f14eef8bb1a0f09c791

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
09473a3c90b80e73ff9f1b4c775a9bb8e2bdbe56da66971db8a78ebd20b98bb1

Original bytes (Base64)

MDk0NzNhM2M5MGI4MGU3M2ZmOWYxYjRjNzc1YTliYjhlMmJkYmU1NmRhNjY5NzFkYjhhNzhlYmQyMGI5OGJiMQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.