Cereal2 · Observed attack

AS28665 UDP flood on 177.136.158.0/24 | 2026-10-10 21:27:50Z

· Event #324672

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T21:27:50.504Z
Recorded

Recorded 153ms after observation

Affected network
177.136.158.0/24
Network operator
Predlink Rede de Telecomunicções LtdaAS28665
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.17.15130.94.32.14137.184.100.23206.189.2.8638.60.199.12638.60.238.10994.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000d7 82 9d 05 50 8e 06 ef....P...
0000000811 bc cb 40 18 b6 b1 29...@...)
000000101a 66 00 20 ea 79 4a 50.f. .yJP
00000018ce 95 d7 da 9e d7 1c 18........

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

7b7ad1e03c233767d8069e517262ff2e8a130c1d36419ee08086aabab2eebc4f

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
d7829d05508e06ef11bccb4018b6b1291a660020ea794a50ce95d7da9ed71c18

Original bytes (Base64)

ZDc4MjlkMDU1MDhlMDZlZjExYmNjYjQwMThiNmIxMjkxYTY2MDAyMGVhNzk0YTUwY2U5NWQ3ZGE5ZWQ3MWMxOA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.