Cereal2 · Observed attack

AS53107 UDP flood on 177.67.52.0/24 | 2026-10-13 18:19:33Z

· Event #328622

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T18:19:33.348Z
Recorded

Recorded 415ms after observation

Affected network
177.67.52.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000006 0a 9c 73 38 36 4c c6...s86L.
00000008eb 13 bc b8 dd 8c 0a 2f......./
0000001004 24 d4 0c 84 33 d6 d4.$...3..
000000184e ab d9 f6 04 de a3 96N.......

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

162e0f13e92a97e0bd4596c78d551d1ac364bbdc8905b9a812ba27f8631a575e

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
060a9c7338364cc6eb13bcb8dd8c0a2f0424d40c8433d6d44eabd9f604dea396

Original bytes (Base64)

MDYwYTljNzMzODM2NGNjNmViMTNiY2I4ZGQ4YzBhMmYwNDI0ZDQwYzg0MzNkNmQ0NGVhYmQ5ZjYwNGRlYTM5Ng==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.