Cereal2 · Observed attack

AS61855 UDP flood on 131.0.7.0/24 | 2026-10-13 00:55:07Z

· Event #327846

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T00:55:07.590Z
Recorded

Recorded 151ms after observation

Affected network
131.0.7.0/24
Network operator
NOVA NET TECNOLOGIA LTDA - MEAS61855
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216139.59.33.238157.230.127.22159.223.68.251165.22.152.158170.106.35.197178.128.223.92188.166.12.8206.189.228.1743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5364.227.72.6877.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
0000000029 50 38 1a 0d 72 e4 12)P8..r..
0000000853 a0 83 5c 45 e4 11 86S..\E...
0000001041 11 a7 fb 2c d4 2f 5cA...,./\
0000001863 6a 7b bb 92 6a c5 cccj{..j..

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

ebcff7b5322fc3d36959686a852771a21f4e2fc99cc9ee0d2adda025997dc596

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
2950381a0d72e41253a0835c45e411864111a7fb2cd42f5c636a7bbb926ac5cc

Original bytes (Base64)

Mjk1MDM4MWEwZDcyZTQxMjUzYTA4MzVjNDVlNDExODY0MTExYTdmYjJjZDQyZjVjNjM2YTdiYmI5MjZhYzVjYw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.