Cereal2 · Observed attack

AS53245 UDP flood on 177.21.71.0/24 | 2026-10-14 03:29:59Z

· Event #329136

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-14T03:29:59.432Z
Recorded

Recorded 171ms after observation

Affected network
177.21.71.0/24
Network operator
ActiON Infinite Communications, Brazil.AS53245
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000023 1a 0b 7d 96 3a 61 0e#..}.:a.
000000081f 79 c0 9d 44 e1 39 26.y..D.9&
00000010d1 01 b5 a9 66 d5 6c ae....f.l.
000000186c 2a e6 6c 0d 88 3c 56l*.l..<V

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

45b9b6e4089b650c9ad808986a6aebe77a88c55cc549a571752db356c4095425

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
231a0b7d963a610e1f79c09d44e13926d101b5a966d56cae6c2ae66c0d883c56

Original bytes (Base64)

MjMxYTBiN2Q5NjNhNjEwZTFmNzljMDlkNDRlMTM5MjZkMTAxYjVhOTY2ZDU2Y2FlNmMyYWU2NmMwZDg4M2M1Ng==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.