Cereal2 · Observed attack

AS53107 UDP flood on 187.108.201.0/24 | 2026-10-13 21:47:34Z

· Event #328844

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T21:47:34.677Z
Recorded

Recorded 553ms after observation

Affected network
187.108.201.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000098 2c d0 d4 ee 3f 38 f7.,...?8.
00000008c5 34 30 05 d0 16 f9 39.40....9
00000010b5 1c d5 a3 42 a9 9e ea....B...
000000187a a0 11 1a df 1e 9c fdz.......

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

a34244844a492efb3fd9e7e3283ef4a74d720e55aa999f52b820b9e2092d4e76

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
982cd0d4ee3f38f7c5343005d016f939b51cd5a342a99eea7aa0111adf1e9cfd

Original bytes (Base64)

OTgyY2QwZDRlZTNmMzhmN2M1MzQzMDA1ZDAxNmY5MzliNTFjZDVhMzQyYTk5ZWVhN2FhMDExMWFkZjFlOWNmZA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.