Cereal2 · Observed attack

AS28665 UDP flood on 177.136.138.0/24 | 2026-10-10 19:17:30Z

· Event #324496

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T19:17:30.505Z
Recorded

Recorded 143ms after observation

Affected network
177.136.138.0/24
Network operator
Predlink Rede de Telecomunicções LtdaAS28665
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.32.14130.94.77.120137.184.100.23206.189.2.8638.60.136.14038.60.199.12638.60.238.10994.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000001d d4 1b f1 0f 41 3a b4.....A:.
00000008da 7c ea c6 5c 0b 08 49.|..\..I
0000001095 82 84 f3 1b 63 1f be.....c..
00000018d2 c5 34 4e 87 d2 75 12..4N..u.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

54bac6ae1de2bdae545d307fd8b389eaaff8780e3819b5704c32b66520522e34

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
1dd41bf10f413ab4da7ceac65c0b0849958284f31b631fbed2c5344e87d27512

Original bytes (Base64)

MWRkNDFiZjEwZjQxM2FiNGRhN2NlYWM2NWMwYjA4NDk5NTgyODRmMzFiNjMxZmJlZDJjNTM0NGU4N2QyNzUxMg==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.