Cereal2 · Observed attack

AS53107 UDP flood on 186.194.55.0/24 | 2026-10-13 21:07:34Z

· Event #328809

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T21:07:34.437Z
Recorded

Recorded 620ms after observation

Affected network
186.194.55.0/24
Network operator
EVEO S.A.AS53107
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000f8 25 ee e7 8c ea bb 66.%.....f
000000088e ff 59 a8 10 c8 c5 cb..Y.....
000000107e 61 68 3e 99 17 be 2e~ah>....
0000001871 68 b7 ca ea 5a 55 3cqh...ZU<

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

c629b680acfd78ccbbef486b3e47fcdd993b2b6e0ae395ee3b0d2efb6d5c1d5c

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
f825eee78ceabb668eff59a810c8c5cb7e61683e9917be2e7168b7caea5a553c

Original bytes (Base64)

ZjgyNWVlZTc4Y2VhYmI2NjhlZmY1OWE4MTBjOGM1Y2I3ZTYxNjgzZTk5MTdiZTJlNzE2OGI3Y2FlYTVhNTUzYw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.