Cereal2 · Observed attack

AS53245 UDP flood on 177.21.71.0/24 | 2026-10-12 23:11:07Z

· Event #327760

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-12T23:11:07.193Z
Recorded

Recorded 304ms after observation

Affected network
177.21.71.0/24
Network operator
ActiON Infinite Communications, Brazil.AS53245
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154139.59.33.238157.230.127.22159.223.68.251164.90.186.13165.22.152.158170.106.35.197178.128.223.92188.166.12.8206.189.228.1743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5364.227.72.6877.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000d3 b3 34 28 50 11 a6 71..4(P..q
0000000801 38 91 b1 ed d1 1c be.8......
00000010fb 4b 4a cf b0 d7 b2 5a.KJ....Z
000000188b a5 4a 9b 4a 33 38 c4..J.J38.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

e35cc2bc491798f7fb46a7a6d0b0b4340e2b2f748c37692bc47bc580438b0a66

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
d3b334285011a671013891b1edd11cbefb4b4acfb0d7b25a8ba54a9b4a3338c4

Original bytes (Base64)

ZDNiMzM0Mjg1MDExYTY3MTAxMzg5MWIxZWRkMTFjYmVmYjRiNGFjZmIwZDdiMjVhOGJhNTRhOWI0YTMzMzhjNA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.