Cereal2 · Observed attack

AS53107 UDP flood on 177.104.142.0/24 | 2026-10-13 18:49:33Z

· Event #328666

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T18:49:33.465Z
Recorded

Recorded 440ms after observation

Affected network
177.104.142.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000008a fa 14 e6 46 9d 28 ac....F.(.
00000008e2 38 5e 90 2f 6f 5c 26.8^./o\&
00000010bd 67 51 d6 ef 9e b6 2a.gQ....*
00000018f9 f8 04 7d 69 a3 2b 41...}i.+A

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

fec0af4ae1ac6a21ac40ba963001bf7eb1af02b1e1aff972fe4345af79730c39

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
8afa14e6469d28ace2385e902f6f5c26bd6751d6ef9eb62af9f8047d69a32b41

Original bytes (Base64)

OGFmYTE0ZTY0NjlkMjhhY2UyMzg1ZTkwMmY2ZjVjMjZiZDY3NTFkNmVmOWViNjJhZjlmODA0N2Q2OWEzMmI0MQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.