Cereal2 · Observed attack

AS268910 UDP flood on 186.209.144.0/24 | 2026-10-13 23:07:35Z

· Event #328909

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T23:07:35.177Z
Recorded

Recorded 514ms after observation

Affected network
186.209.144.0/24
Network operator
AGIL COMERCIAL DO BRASIL INF. E COM. LTDAAS268910
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000003b cd 87 6a 17 66 81 38;..j.f.8
000000080c 25 77 f7 a6 8e 90 39.%w....9
0000001019 98 3e 0c 5f bc a6 4f..>._..O
0000001817 91 90 ca ff eb ed a3........

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

4a855faf2d9fb7f304f34f266cd42d3d02eeda8c7906d8461206136bdfe8d32c

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
3bcd876a176681380c2577f7a68e903919983e0c5fbca64f179190caffebeda3

Original bytes (Base64)

M2JjZDg3NmExNzY2ODEzODBjMjU3N2Y3YTY4ZTkwMzkxOTk4M2UwYzVmYmNhNjRmMTc5MTkwY2FmZmViZWRhMw==

Other attacks on this network

Within 24 hours of this observation

No other observations within 24 hours.

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.