Cereal2 · Observed attack

AS53107 UDP flood on 187.110.166.0/24 | 2026-10-13 22:13:34Z

· Event #328865

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T22:13:34.829Z
Recorded

Recorded 450ms after observation

Affected network
187.110.166.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000a1 5f 83 18 63 da 35 ee._..c.5.
00000008da de 10 ec d7 e1 e2 83........
00000010cd 5d 4f 3a 89 40 27 56.]O:.@'V
0000001871 ea 0a 60 00 bc 0a 61q..`...a

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

8db3a18bd90d87a8eb84885c15620e4ebf8fe7fcbcc4b5091bae02761a861522

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
a15f831863da35eedade10ecd7e1e283cd5d4f3a8940275671ea0a6000bc0a61

Original bytes (Base64)

YTE1ZjgzMTg2M2RhMzVlZWRhZGUxMGVjZDdlMWUyODNjZDVkNGYzYTg5NDAyNzU2NzFlYTBhNjAwMGJjMGE2MQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.