Cereal2 · Observed attack

AS270516 UDP flood on 187.73.181.0/24 | 2026-10-09 23:12:27Z

· Event #321992

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-09T23:12:27.188Z
Recorded

Recorded 2s after observation

Affected network
187.73.181.0/24
Network operator
IZOC SERVICOS DE INTERNET LTDAAS270516
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
130.94.1.105130.94.107.174130.94.16.10130.94.17.15130.94.32.14130.94.77.120134.122.68.238137.184.100.23138.68.128.163157.230.254.212167.172.93.168168.144.113.82206.189.2.86209.38.240.4438.60.136.14038.60.199.12638.60.238.10943.157.80.2943.173.37.19747.237.95.14994.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000007d 4d 08 48 1b 33 c6 b4}M.H.3..
00000008de 33 98 d1 f7 bf 66 6c.3....fl
0000001076 2f dc e6 fd 45 37 34v/...E74
0000001801 cd e4 40 b6 85 8a 0e...@....

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

e1607de566033b44fd9c763665029f2ce788ff0f15a5cb486ba4cb1dbdc9d8b1

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
7d4d08481b33c6b4de3398d1f7bf666c762fdce6fd45373401cde440b6858a0e

Original bytes (Base64)

N2Q0ZDA4NDgxYjMzYzZiNGRlMzM5OGQxZjdiZjY2NmM3NjJmZGNlNmZkNDUzNzM0MDFjZGU0NDBiNjg1OGEwZQ==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.