Cereal2 · Observed attack

AS53245 UDP flood on 177.21.74.0/23 | 2026-10-14 03:37:59Z

· Event #329143

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-14T03:37:59.478Z
Recorded

Recorded 141ms after observation

Affected network
177.21.74.0/23
Network operator
ActiON Infinite Communications, Brazil.AS53245
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000074 92 de b0 03 45 a2 dbt....E..
0000000868 b2 27 fa 3b eb a0 59h.'.;..Y
0000001045 36 93 08 0c b4 39 00E6....9.
00000018b8 a8 d3 14 8b b3 95 55.......U

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

5c7ba5579c0dc5e186b768a1bd37e46586191dc97e6c5aa4688278ec3bc0232b

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
7492deb00345a2db68b227fa3beba059453693080cb43900b8a8d3148bb39555

Original bytes (Base64)

NzQ5MmRlYjAwMzQ1YTJkYjY4YjIyN2ZhM2JlYmEwNTk0NTM2OTMwODBjYjQzOTAwYjhhOGQzMTQ4YmIzOTU1NQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.