Cereal2 · Observed attack

AS28146 UDP flood on 186.236.25.0/24 | 2026-10-13 00:27:07Z

· Event #327823

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T00:27:07.477Z
Recorded

Recorded 268ms after observation

Affected network
186.236.25.0/24
Network operator
MHNET TELECOMAS28146
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216139.59.33.238157.230.127.22159.223.68.251164.90.186.13165.22.152.158170.106.35.197178.128.223.92188.166.12.8206.189.228.1743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5364.227.72.6877.232.43.2194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000a7 33 d3 c4 1f 48 a4 9c.3...H..
0000000830 af d7 af dd a9 ce 9a0.......
000000104f 5a f3 07 0a 0a 93 2eOZ......
00000018f7 7e ff 68 42 dd f6 90.~.hB...

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

632cab9f5e3414abf93ae5c01ee6e9c1447b708c288688b6db6ff51d04d09352

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
a733d3c41f48a49c30afd7afdda9ce9a4f5af3070a0a932ef77eff6842ddf690

Original bytes (Base64)

YTczM2QzYzQxZjQ4YTQ5YzMwYWZkN2FmZGRhOWNlOWE0ZjVhZjMwNzBhMGE5MzJlZjc3ZWZmNjg0MmRkZjY5MA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.