Cereal2 · Observed attack

AS266948 UDP flood on 45.225.192.0/23 | 2026-10-13 00:39:07Z

· Event #327833

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T00:39:07.524Z
Recorded

Recorded 147ms after observation

Affected network
45.225.192.0/23
Network operator
IBIUNET MULTIPLAYAS266948
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154139.59.33.238157.230.127.22159.223.68.251165.22.152.158170.106.35.197178.128.223.92188.166.12.8206.189.228.1743.136.129.13143.157.198.13743.159.46.15543.173.37.5364.227.72.6877.232.43.2194.183.235.1194.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000c4 46 e7 9a a1 e7 14 dc.F......
0000000817 94 58 bc 8d 85 b7 1a..X.....
00000010cb 9f fe 1e 9c b4 bf c4........
000000182a 10 04 50 bc 15 36 56*..P..6V

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

3e7cb4043b00bf15102e31f5910227ba82995c28d438d3a82fddffdb63207c78

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
c446e79aa1e714dc179458bc8d85b71acb9ffe1e9cb4bfc42a100450bc153656

Original bytes (Base64)

YzQ0NmU3OWFhMWU3MTRkYzE3OTQ1OGJjOGQ4NWI3MWFjYjlmZmUxZTljYjRiZmM0MmExMDA0NTBiYzE1MzY1Ng==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.