Cereal2 · Observed attack

AS53107 UDP flood on 177.104.164.0/24 | 2026-10-10 00:46:27Z

· Event #322294

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T00:46:27.166Z
Recorded

Recorded 148ms after observation

Affected network
177.104.164.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.17.15130.94.32.14134.122.68.238137.184.100.23138.68.128.163157.230.254.212167.172.93.168168.144.113.82206.189.2.8638.60.136.14038.60.199.12638.60.238.10943.173.102.17347.237.95.14994.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000d9 17 a2 ea 8b 75 1b ca.....u..
0000000885 8f df df a8 d4 f0 cc........
00000010a1 cc 5b 69 3a c5 16 24..[i:..$
00000018c4 30 26 e7 ff 16 35 27.0&...5'

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

980b03585c6a567cd7e31523ba517cda3ace629ae8436eb12e8a8699a6eb464e

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
d917a2ea8b751bca858fdfdfa8d4f0cca1cc5b693ac51624c43026e7ff163527

Original bytes (Base64)

ZDkxN2EyZWE4Yjc1MWJjYTg1OGZkZmRmYThkNGYwY2NhMWNjNWI2OTNhYzUxNjI0YzQzMDI2ZTdmZjE2MzUyNw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.