Cereal2 · Observed attack

AS53107 UDP flood on 177.93.106.0/24 | 2026-10-13 18:27:33Z

· Event #328637

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T18:27:33.356Z
Recorded

Recorded 505ms after observation

Affected network
177.93.106.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000e5 4f 72 9e bf 70 54 0d.Or..pT.
00000008e4 7f 9e fd 7d 91 07 87....}...
00000010f6 94 c3 8b 71 25 b9 e8....q%..
00000018ac 98 e7 0f a6 01 fa e3........

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

09b69ce769ed8b3cd2ddcde0cd53b0ea2419161938bd94a837e0aae94a7a15fc

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
e54f729ebf70540de47f9efd7d910787f694c38b7125b9e8ac98e70fa601fae3

Original bytes (Base64)

ZTU0ZjcyOWViZjcwNTQwZGU0N2Y5ZWZkN2Q5MTA3ODdmNjk0YzM4YjcxMjViOWU4YWM5OGU3MGZhNjAxZmFlMw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.