ZOLIM - Zoque-Observatorio Latinoamericano de Infraestructura Maliciosa

ZOLIM (Observatorio Latinoamericano de Infraestructura Maliciosa de Zoque) es una iniciativa de investigación de ZoqueLabs orientada a documentar, analizar y publicar snapshots periódicos de infraestructura maliciosa en América Latina, con énfasis en sistemas de comando y control (C2) y tooling asociado.

• Generated: 2026-10-30T17:51:10Z
• Current snapshot: En GitLab
• About ZOLIM: Español - English

Metrics (current)

IPs: 307

Unique ports: 56

Threat frameworks: 14

Countries: 14

Cities: 74

ASNs: 105

Tops (current)

• Threats: GoPhish(173) Sliver(35) Quasar(28) DCRat(16) AsyncRAT(16) Havoc(16) Hack5 Cloud C2(13) Cobalt Strike(11) CHAOS(9) Metasploit(4) UnamWebPanel(1) Mythic(1)
• Countries: Brazil(131) Colombia(57) Chile(37) Mexico(32) Argentina(15) Peru(12) Panama(6) Venezuela, Bolivarian Republic of(6) Paraguay(3) Costa Rica(2) Ecuador(2) Honduras(2)
• Cities: São Paulo(84) Santiago(29) Valledupar(18) Lima(12) Bucaramanga(11) Barranquilla(9) Buenos Aires(7) Campinas(7) Mexico City(7) Bogotá(7) Rosario(7) Panamá(5)
• ASNs: 3816(36) 31898(25) 7418(21) 16509(14) 8075(9) 20473(9) 8151(8) 396982(7) 47583(7) 27831(6) 63949(6) 27823(6)
• ISPs: AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(24) ORACLE-BMC-31898 - Oracle Corporation(19) AMAZON-02 - Amazon.com, Inc.(12) COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(12) TELEFÓNICA CHILE S.A.(11) AS7418 - TELEFONICA CHILE S.A.(7) GOOGLE-CLOUD-PLATFORM - Google LLC(6) Oracle Corporation(6) UNINET(6) AS-HOSTINGER(6) AS-VULTR - The Constant Company, LLC(6) Microsoft Corporation(5)
• Orgs: unknown(195) TELEFÓNICA CHILE S.A.(10) Oracle Corporation(6) Microsoft Corporation(5) Uninet S.A. de C.V.(5) TELEFÔNICA BRASIL S.A(3) ZAM LTDA.(3) ETB - Colombia(3) Globenet Cabos Submarinos America Inc.(3) The Constant Company, LLC(3) TELEFONICA MOVIL DE CHILE S.A.(3) Cogent Communications, LLC(3)
• Ports (frequency across IPs): 3333(100) 443(37) 31337(34) 8080(27) 8443(17) 80(15) 9090(9) 8848(5) 8081(5) 9000(4) 43333(4) 6000(4)

Graphs (current)

---
config:
  theme: dark
---
pie title Threats
  "GoPhish" : 173
  "Sliver" : 35
  "Quasar" : 28
  "DCRat" : 16
  "AsyncRAT" : 16
  "Havoc" : 16
  "Hack5 Cloud C2" : 13
  "Cobalt Strike" : 11
  "CHAOS" : 9
  "Metasploit" : 4
  "UnamWebPanel" : 1
  "Mythic" : 1

---
config:
  theme: dark
---
pie title Countries
  "Brazil" : 131
  "Colombia" : 57
  "Chile" : 37
  "Mexico" : 32
  "Argentina" : 15
  "Peru" : 12
  "Panama" : 6
  "Venezuela, Bolivarian Republic of" : 6
  "Paraguay" : 3
  "Costa Rica" : 2
  "Ecuador" : 2
  "Honduras" : 2

---
config:
  theme: dark
---
pie title ASNs
  "3816" : 36
  "31898" : 25
  "7418" : 21
  "16509" : 14
  "8075" : 9
  "20473" : 9
  "8151" : 8
  "396982" : 7
  "47583" : 7
  "27831" : 6
  "63949" : 6
  "27823" : 6

---
config:
  theme: dark
---
pie title ISPs
  "AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 24
  "ORACLE-BMC-31898 - Oracle Corporation" : 19
  "AMAZON-02 - Amazon.com, Inc." : 12
  "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 12
  "TELEFÓNICA CHILE S.A." : 11
  "AS7418 - TELEFONICA CHILE S.A." : 7
  "GOOGLE-CLOUD-PLATFORM - Google LLC" : 6
  "Oracle Corporation" : 6
  "UNINET" : 6
  "AS-HOSTINGER" : 6
  "AS-VULTR - The Constant Company, LLC" : 6
  "Microsoft Corporation" : 5

Country → Threat (top)

---
config:
  theme: dark
---
%% Country → Threat (top)
sankey-beta
  Brazil,GoPhish,66
  Colombia,GoPhish,30
  Chile,GoPhish,26
  Brazil,Sliver,20
  Mexico,GoPhish,17
  Colombia,AsyncRAT,14
  Colombia,DCRat,13
  Argentina,GoPhish,13
  Brazil,Quasar,12
  Brazil,Havoc,12
  Mexico,Sliver,11
  Chile,Hack5 Cloud C2,10
  Peru,GoPhish,9
  Brazil,Cobalt Strike,7
  Colombia,Quasar,7
  Paraguay,GoPhish,3
  Mexico,Quasar,3
  Venezuela  Bolivarian Republic of,Cobalt Strike,3
  Brazil,CHAOS,3
  Brazil,Metasploit,3
  Brazil,Hack5 Cloud C2,2
  Panama,Sliver,2
  Costa Rica,GoPhish,2
  Ecuador,GoPhish,2
  Brazil,DCRat,2
  Chile,Quasar,2
  Panama,GoPhish,2
  Peru,Havoc,2
  Brazil,AsyncRAT,2
  Peru,CHAOS,2

ASN → Threat (top)

---
config:
  theme: dark
---
%% ASN → Threat (top)
sankey-beta
  3816,GoPhish,21
  31898,GoPhish,17
  3816,AsyncRAT,12
  7418,Hack5 Cloud C2,10
  7418,GoPhish,10
  396982,GoPhish,7
  16509,GoPhish,7
  52368,GoPhish,7
  20473,GoPhish,7
  3816,Quasar,6
  27831,DCRat,5
  27823,GoPhish,5
  3816,DCRat,5
  8151,Sliver,5
  16735,GoPhish,4
  3132,GoPhish,4
  271239,GoPhish,4
  8075,GoPhish,4
  13489,DCRat,3
  12252,GoPhish,3
  15830,GoPhish,3
  11014,GoPhish,3
  16509,Quasar,3
  18747,GoPhish,3
  47583,GoPhish,3
  31898,Sliver,3
  138915,CHAOS,3
  Not Found,Sliver,3
  270564,Quasar,2
  23201,GoPhish,2

Delta vs previous snapshot

• IPs: +8 / -0 (persistent: 299)
• Threat frameworks: +0 / -0
• Countries: +0 / -0
• ASNs: +2 / -0
• ISPs: +8 / -5
• Orgs: +5 / -5
• Ports: +2 / -0
• Cities: +4 / -2

Delta lists (compact)

• New IPs: 129.121.62.230, 149.104.90.251, 170.231.239.144, 172.233.1.52, 186.155.2.137, 186.216.55.16, 191.107.91.119, 45.225.135.43
• Removed IPs: none
• New threats: none
• Removed threats: none
• New countries: none
• New ASNs: 264617, 64107
• New ISPs: AS266523 - M V F TELECOM E SERVICOS LTDA, AS28137 - Vialink Solucoes de Tecnologia Ltda, AS7303 - Telecom Argentina S.A., GRUPO PANAGLOBAL 15 S.A, LIGHT4-AS-AP LIGHT NODE LIMITED, Ligga Telecomunicacoes S.A., RACK SPHERE HOSTING S.A., TRANSTELCO-INC - Transtelco Inc
• New ports: 5439, 8818

IP reuse / threat drift

• IPs with threat changes: 1
  • 147.15.78.253: [‘GoPhish’, ‘Sliver’] → [‘Sliver’] (+[], -[‘GoPhish’])

Delta graph: NEW Country → Threat edges

---
config:
  theme: dark
---
%% Δ Country → Threat (new edges)
sankey-beta
  Mexico,CHAOS,2
  Panama,Cobalt Strike,1

Delta graph: NEW ASN → Threat edges

---
config:
  theme: dark
---
%% Δ ASN → Threat (new edges)
sankey-beta
  154177,CHAOS,2
  53107,Havoc,1
  64107,Sliver,1
  264617,Cobalt Strike,1

All IPs (current snapshot)

Current snapshot link: https://gitlab.com/zoquelabs/olim_datasets/-/tree/main/reports/2026-10-30_12-51-10?ref_type=heads