Cereal2 · Observed attack

AS53102 UDP flood on 187.103.166.0/24 | 2026-10-13 02:05:07Z

· Event #327902

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T02:05:07.856Z
Recorded

Recorded 189ms after observation

Affected network
187.103.166.0/24
Network operator
S.I. TELECOM. SERVICOS DE TELEFONIA LTDA EPPAS53102
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216139.59.33.238157.230.127.22159.223.68.251164.90.186.13165.22.152.158170.106.35.197178.128.223.92206.189.228.1743.153.106.22964.227.72.6882.157.209.4194.183.235.1194.183.235.14294.183.235.15995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000001b b5 02 ab 2d c7 cc a4....-...
0000000808 1f cf 77 cb 8b b3 d5...w....
0000001057 c8 76 e8 be 51 db 35W.v..Q.5
0000001808 5c 45 c7 88 b3 4b fd.\E...K.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

e893af215923e1591cf4bc6d7d95aadf77034d765f4efb1f08612080bcc3a26c

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
1bb502ab2dc7cca4081fcf77cb8bb3d557c876e8be51db35085c45c788b34bfd

Original bytes (Base64)

MWJiNTAyYWIyZGM3Y2NhNDA4MWZjZjc3Y2I4YmIzZDU1N2M4NzZlOGJlNTFkYjM1MDg1YzQ1Yzc4OGIzNGJmZA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.