Cereal2 · Observed attack

AS263924 UDP flood on 168.232.172.0/23 | 2026-10-10 22:53:50Z

· Event #324777

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-10T22:53:50.854Z
Recorded

Recorded 150ms after observation

Affected network
168.232.172.0/23
Network operator
Sonik Serviços de Comunicação LTDAAS263924
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14130.94.77.120137.184.100.23206.189.2.8638.60.199.12638.60.238.10994.183.235.1194.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000007b 84 45 66 f7 7d 8a b8{.Ef.}..
0000000860 c0 f3 f4 24 0e 57 74`...$.Wt
00000010a7 f1 08 31 4f 04 92 07...1O...
0000001821 01 4b 06 bb 14 b5 69!.K....i

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

cd757e720fa05ee39cc53a9b84fd0b118e299114f1c0c2ec5e3574ca4f064289

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
7b844566f77d8ab860c0f3f4240e5774a7f108314f04920721014b06bb14b569

Original bytes (Base64)

N2I4NDQ1NjZmNzdkOGFiODYwYzBmM2Y0MjQwZTU3NzRhN2YxMDgzMTRmMDQ5MjA3MjEwMTRiMDZiYjE0YjU2OQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.