Cereal2 · Observed attack

AS16276 UDP flood on 54.38.117.76 | 2026-10-10 13:52:44Z

· Event #324101

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T13:52:44.377Z
Recorded

Recorded 360ms after observation

Affected network
54.38.117.76/32
Network operator
OVH SASAS16276
Location
France
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
1181
Commanded duration
30s
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14130.94.77.120137.184.100.23206.189.2.8638.60.136.14038.60.199.12638.60.238.10994.183.235.1194.183.235.14294.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 15 bytes

Decoded template · 15 bytes

OffsetHexadecimalASCII
0000000053 41 4d 50 90 d9 1d 4dSAMP...M
0000000861 1e 70 0a 46 5b 00 a.p.F[.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

02b661c7e8ef9e89386404a12bcd6811979ef60c2986cc2ceb32d08840052c27

Configured datagram length
1400 bytes
Minimum length option
0 (no range requested)
Maximum length option
0 (no range requested)

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
53414d5090d91d4d611e700a465b00

Original bytes (Base64)

NTM0MTRkNTA5MGQ5MWQ0ZDYxMWU3MDBhNDY1YjAw

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

No other observations within 24 hours.

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.