Cereal2 · Observed attack

AS264076 UDP flood on 143.202.187.0/24 | 2026-10-10 17:47:30Z

· Event #324378

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T17:47:30.118Z
Recorded

Recorded 142ms after observation

Affected network
143.202.187.0/24
Network operator
BREM TECHNOLOGY LTDAAS264076
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14130.94.77.120137.184.100.23206.189.2.8638.60.136.14038.60.199.12638.60.238.10994.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000fd 04 b8 08 4d 53 d5 75....MS.u
0000000821 c2 e5 96 2f 91 cb 44!.../..D
000000109c 6f fc b0 d9 69 d2 c9.o...i..
00000018d0 b0 90 58 d7 c1 bf e4...X....

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

d7f87c45d255ee52c4f9f6161d8368514ef5123911d834ff38e5e67b076953e5

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
fd04b8084d53d57521c2e5962f91cb449c6ffcb0d969d2c9d0b09058d7c1bfe4

Original bytes (Base64)

ZmQwNGI4MDg0ZDUzZDU3NTIxYzJlNTk2MmY5MWNiNDQ5YzZmZmNiMGQ5NjlkMmM5ZDBiMDkwNThkN2MxYmZlNA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.