Cereal2 · Observed attack

AS61754 UDP flood on 170.83.68.0/24 | 2026-10-10 21:51:50Z

· Event #324702

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T21:51:50.600Z
Recorded

Recorded 360ms after observation

Affected network
170.83.68.0/24
Network operator
I3 Telecomunicacoes - EIRELIAS61754
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14130.94.77.120137.184.100.23206.189.2.8638.60.136.14038.60.199.12638.60.238.10994.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000051 d2 da 98 42 34 5f 3aQ...B4_:
00000008a6 e4 11 cf 98 6b 61 5a.....kaZ
00000010cf d1 98 cc 6b 1b 09 28....k..(
00000018f0 96 31 fc b9 58 c5 ed..1..X..

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

10c74c136e4fd6a5e747d1d32e1b852afe6fde8a135ebc236f95e583f6d682b0

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
51d2da9842345f3aa6e411cf986b615acfd198cc6b1b0928f09631fcb958c5ed

Original bytes (Base64)

NTFkMmRhOTg0MjM0NWYzYWE2ZTQxMWNmOTg2YjYxNWFjZmQxOThjYzZiMWIwOTI4ZjA5NjMxZmNiOTU4YzVlZA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.