Cereal2 · Observed attack

AS53245 UDP flood on 177.21.68.0/24 | 2026-10-12 23:03:07Z

· Event #327754

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-12T23:03:07.128Z
Recorded

Recorded 151ms after observation

Affected network
177.21.68.0/24
Network operator
ActiON Infinite Communications, Brazil.AS53245
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154139.59.33.238157.230.127.22159.223.68.251164.90.186.13165.22.152.158178.128.223.92188.166.12.8206.189.228.1743.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5364.227.72.6877.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.249

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000008c 47 9d 15 b9 d3 d2 eb.G......
00000008d7 f7 ec 2d d9 20 d0 bd...-. ..
0000001091 8a 24 26 15 88 fc 3e..$&...>
0000001848 ee 24 9d c6 df 76 47H.$...vG

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

551269dd5d2b8593ac4e19df38813c2525689e0a86786a9c82cfbfdd9fd86d4e

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
8c479d15b9d3d2ebd7f7ec2dd920d0bd918a24261588fc3e48ee249dc6df7647

Original bytes (Base64)

OGM0NzlkMTViOWQzZDJlYmQ3ZjdlYzJkZDkyMGQwYmQ5MThhMjQyNjE1ODhmYzNlNDhlZTI0OWRjNmRmNzY0Nw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.