Cereal2 · Observed attack

AS266936 UDP flood on 45.225.126.0/23 | 2026-10-13 03:03:08Z

· Event #327952

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T03:03:08.112Z
Recorded

Recorded 536ms after observation

Affected network
45.225.126.0/23
Network operator
MT-TELECOM SULAS266936
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154139.59.33.238157.230.127.22159.223.68.251164.90.186.13170.106.35.197178.128.223.92188.166.12.8206.189.228.1743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5364.227.72.6877.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000c8 cc 49 fd 5c 62 b8 27..I.\b.'
000000089c b0 c7 89 26 b0 54 92....&.T.
0000001070 52 8a 04 29 be c1 c1pR..)...
000000182c 60 42 64 05 0f d5 01,`Bd....

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

5e5fe2a05006f5fdc52e6b00eac90dc29c1028a789ef408c23ff9ee3530fc5de

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
c8cc49fd5c62b8279cb0c78926b0549270528a0429bec1c12c604264050fd501

Original bytes (Base64)

YzhjYzQ5ZmQ1YzYyYjgyNzljYjBjNzg5MjZiMDU0OTI3MDUyOGEwNDI5YmVjMWMxMmM2MDQyNjQwNTBmZDUwMQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.