Cereal2 · Observed attack

AS53102 UDP flood on 186.195.63.0/24 | 2026-10-14 08:52:03Z

· Event #329407

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-14T08:52:03.335Z
Recorded

Recorded 139ms after observation

Affected network
186.195.63.0/24
Network operator
S.I. TELECOM. SERVICOS DE TELEFONIA LTDA EPPAS53102
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000a1 6e 6e 9d a1 34 30 29.nn..40)
0000000891 98 ca 24 23 f6 38 ac...$#.8.
0000001047 59 d9 c1 17 e1 2e 13GY......
000000184e 70 2d bf 41 10 2f dfNp-.A./.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

7a730d0a7d2e5f4b8524e08f45e4c6cddd17efa3331977a979353c84bf40897a

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
a16e6e9da13430299198ca2423f638ac4759d9c117e12e134e702dbf41102fdf

Original bytes (Base64)

YTE2ZTZlOWRhMTM0MzAyOTkxOThjYTI0MjNmNjM4YWM0NzU5ZDljMTE3ZTEyZTEzNGU3MDJkYmY0MTEwMmZkZg==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.