Cereal2 · Observed attack

AS53245 UDP flood on 177.21.72.0/23 | 2026-10-10 22:23:50Z

· Event #324739

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T22:23:50.735Z
Recorded

Recorded 138ms after observation

Affected network
177.21.72.0/23
Network operator
ActiON Infinite Communications, Brazil.AS53245
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14130.94.77.120137.184.100.23206.189.2.8638.60.136.14038.60.199.12694.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000f4 5a c3 0a 4a 9e de 07.Z..J...
00000008ac 0b a9 fb 19 59 41 47.....YAG
0000001051 bd 46 1b 47 f3 16 28Q.F.G..(
0000001847 a1 18 47 d0 cd e4 fdG..G....

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

e370ac7d89d4e5c29e2393b525ae7b8c62096396e159c980f4c713c5b655a6ec

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
f45ac30a4a9ede07ac0ba9fb1959414751bd461b47f3162847a11847d0cde4fd

Original bytes (Base64)

ZjQ1YWMzMGE0YTllZGUwN2FjMGJhOWZiMTk1OTQxNDc1MWJkNDYxYjQ3ZjMxNjI4NDdhMTE4NDdkMGNkZTRmZA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.