Cereal2 · Observed attack

AS262503 UDP flood on 167.249.168.0/24 | 2026-10-14 01:27:36Z

· Event #329023

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-14T01:27:36.101Z
Recorded

Recorded 161ms after observation

Affected network
167.249.168.0/24
Network operator
WIKI TELECOMUNICACOES EIRELIAS262503
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000002 45 2f 16 f4 d0 b7 7e.E/....~
000000080e 8c e2 f7 b6 36 b3 5c.....6.\
0000001047 ec ce 92 c5 87 22 13G.....".
000000189d 9a 6a 3d 5b 1d 3f e7..j=[.?.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

1aaf3ef65535f5762dcc4245f92b8abd4213400ea15c8e89496c7d6a6a6e5f6d

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
02452f16f4d0b77e0e8ce2f7b636b35c47ecce92c58722139d9a6a3d5b1d3fe7

Original bytes (Base64)

MDI0NTJmMTZmNGQwYjc3ZTBlOGNlMmY3YjYzNmIzNWM0N2VjY2U5MmM1ODcyMjEzOWQ5YTZhM2Q1YjFkM2ZlNw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.