Cereal2 · Observed attack

AS52571 UDP flood on 132.255.191.0/24 | 2026-10-14 06:54:01Z

· Event #329287

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-14T06:54:01.721Z
Recorded

Recorded 162ms after observation

Affected network
132.255.191.0/24
Network operator
G2G COM PROD ELETRO E SERV LTDAAS52571
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15577.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000bb 3d ad de 1d 7c 2c 81.=...|,.
0000000810 02 b2 3d 75 41 8e 3e...=uA.>
0000001093 f8 5d e6 7f 42 e7 6b..]..B.k
000000180a 2f f8 b1 1c 15 61 fa./....a.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

e2f2d71bede44a84541b16bb4206ee6f52925116c3335a7ae34878028b192567

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
bb3dadde1d7c2c811002b23d75418e3e93f85de67f42e76b0a2ff8b11c1561fa

Original bytes (Base64)

YmIzZGFkZGUxZDdjMmM4MTEwMDJiMjNkNzU0MThlM2U5M2Y4NWRlNjdmNDJlNzZiMGEyZmY4YjExYzE1NjFmYQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.