Cereal2 · Observed attack

AS52630 UDP flood on 179.189.22.0/24 | 2026-10-13 02:45:08Z

· Event #327939

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T02:45:08.056Z
Recorded

Recorded 148ms after observation

Affected network
179.189.22.0/24
Network operator
MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFOAS52630
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154139.59.33.238157.230.127.22159.223.68.251164.90.186.13165.22.152.158170.106.35.197178.128.223.92188.166.12.843.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5364.227.72.6877.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000007e 97 f7 2a 86 a5 03 96~..*....
00000008de b1 a9 77 3b f4 7d 7d...w;.}}
0000001096 76 fd 3b 5b a3 98 dd.v.;[...
00000018d8 90 37 eb 1b 48 09 53..7..H.S

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

dc9ce47f3776a586d9d4dea2b9727004ae254557a4890e12e0dc16bf8d9eb1ba

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
7e97f72a86a50396deb1a9773bf47d7d9676fd3b5ba398ddd89037eb1b480953

Original bytes (Base64)

N2U5N2Y3MmE4NmE1MDM5NmRlYjFhOTc3M2JmNDdkN2Q5Njc2ZmQzYjViYTM5OGRkZDg5MDM3ZWIxYjQ4MDk1Mw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.