Cereal2 · Observed attack

AS53245 UDP flood on 177.21.76.0/24 | 2026-10-10 22:37:50Z

· Event #324755

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T22:37:50.789Z
Recorded

Recorded 423ms after observation

Affected network
177.21.76.0/24
Network operator
ActiON Infinite Communications, Brazil.AS53245
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14137.184.100.23206.189.2.8638.60.199.12638.60.238.10994.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000a7 05 79 4a 29 44 44 05..yJ)DD.
0000000886 d0 06 53 67 9b 9f 59...Sg..Y
000000102e 25 44 6b 43 88 ba 97.%DkC...
0000001881 80 7d 76 76 46 93 e3..}vvF..

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

a1c2c9e717b96a588a13c9542c36a5745a369f16cda2a998b92c27e61eca6d60

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
a705794a2944440586d00653679b9f592e25446b4388ba9781807d76764693e3

Original bytes (Base64)

YTcwNTc5NGEyOTQ0NDQwNTg2ZDAwNjUzNjc5YjlmNTkyZTI1NDQ2YjQzODhiYTk3ODE4MDdkNzY3NjQ2OTNlMw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.