Cereal2 · Observed attack

AS53107 UDP flood on 177.136.224.0/24 | 2026-10-10 01:42:26Z

· Event #322457

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T01:42:26.880Z
Recorded

Recorded 423ms after observation

Affected network
177.136.224.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14134.122.68.238137.184.100.23138.68.128.163157.230.254.212167.172.93.168168.144.113.82206.189.2.86209.38.240.4438.60.136.14038.60.199.12638.60.238.10943.157.80.2943.166.73.11243.173.37.19747.237.95.14994.183.235.1194.183.235.14294.183.235.15994.183.235.249

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000031 ab ee bd 30 0e 7e b51...0.~.
00000008db 4d c5 2a b1 e0 57 3e.M.*..W>
00000010c0 40 74 83 4e 97 82 a3.@t.N...
000000189d ca 93 9b bb 48 03 35.....H.5

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

ac2a772e01b806a8686e7bca72bae71b7ae1361b356232ebfb44e9ef8f5cffdd

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
31abeebd300e7eb5db4dc52ab1e0573ec04074834e9782a39dca939bbb480335

Original bytes (Base64)

MzFhYmVlYmQzMDBlN2ViNWRiNGRjNTJhYjFlMDU3M2VjMDQwNzQ4MzRlOTc4MmEzOWRjYTkzOWJiYjQ4MDMzNQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.