Cereal2 · Observed attack

AS266488 UDP flood on 170.244.4.0/23 | 2026-10-10 20:19:50Z

· Event #324581

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T20:19:50.217Z
Recorded

Recorded 71ms after observation

Affected network
170.244.4.0/23
Network operator
Fatima Aparecida de Almeida - MEAS266488
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14130.94.77.120137.184.100.23206.189.2.8638.60.136.14038.60.199.12638.60.238.10994.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000033 66 1d ba 32 ac a6 553f..2..U
00000008e1 5b 44 92 b6 f7 2f b8.[D.../.
00000010cb 06 58 35 ba 5f 84 a5..X5._..
0000001806 47 ea 9c ea 58 e3 70.G...X.p

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

353fda152e714877842fa52bed15663aee067a24c551def6375c51fa73b59979

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
33661dba32aca655e15b4492b6f72fb8cb065835ba5f84a50647ea9cea58e370

Original bytes (Base64)

MzM2NjFkYmEzMmFjYTY1NWUxNWI0NDkyYjZmNzJmYjhjYjA2NTgzNWJhNWY4NGE1MDY0N2VhOWNlYTU4ZTM3MA==

Other attacks on this network

Within 24 hours of this observation

No other observations within 24 hours.

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.