Cereal2 · Observed attack

AS53107 UDP flood on 131.100.228.0/23 | 2026-10-09 23:22:28Z

· Event #322031

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-09T23:22:28.286Z
Recorded

Recorded 4s after observation

Affected network
131.100.228.0/23
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14134.122.68.238137.184.100.23138.68.128.163157.230.254.212167.172.93.168168.144.113.82206.189.2.86209.38.240.4438.60.136.14038.60.238.10943.166.73.11243.173.37.19747.237.95.14947.85.194.7994.183.235.1194.183.235.14294.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000008f ac f5 09 fd 50 54 93.....PT.
00000008df c9 dc 15 f7 31 9d 3a.....1.:
000000107f 0b 19 78 ba 45 b4 09...x.E..
00000018fc 6a 86 1d f4 f5 a5 ed.j......

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

8c2fc11ab2aea281d9ddf64aec25a7ac489fc324199ccc28f33fe830b3fa0665

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
8facf509fd505493dfc9dc15f7319d3a7f0b1978ba45b409fc6a861df4f5a5ed

Original bytes (Base64)

OGZhY2Y1MDlmZDUwNTQ5M2RmYzlkYzE1ZjczMTlkM2E3ZjBiMTk3OGJhNDViNDA5ZmM2YTg2MWRmNGY1YTVlZA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.