Cereal2 · Observed attack

AS266346 UDP flood on 45.181.59.0/24 | 2026-10-14 10:04:04Z

· Event #329480

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-14T10:04:04.101Z
Recorded

Recorded 136ms after observation

Affected network
45.181.59.0/24
Network operator
G2G NETWORKS SERVICOS DE COMUNICACAOAS266346
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000011 1a f5 b6 7e f9 61 03....~.a.
00000008b8 f3 33 a4 13 42 18 1e..3..B..
00000010a9 5a 3f 49 62 34 6b 0d.Z?Ib4k.
000000180b c9 ea 59 c2 b1 cc 8b...Y....

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

7ff87467bc48fe00e6c30fe131b6356c2ec2ec45abfc64e5a45b4b343a81d6f1

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
111af5b67ef96103b8f333a41342181ea95a3f4962346b0d0bc9ea59c2b1cc8b

Original bytes (Base64)

MTExYWY1YjY3ZWY5NjEwM2I4ZjMzM2E0MTM0MjE4MWVhOTVhM2Y0OTYyMzQ2YjBkMGJjOWVhNTljMmIxY2M4Yg==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.