ZOLIM - Zoque-Observatorio Latinoamericano de Infraestructura Maliciosa

ZOLIM (Observatorio Latinoamericano de Infraestructura Maliciosa de Zoque) es una iniciativa de investigación de ZoqueLabs orientada a documentar, analizar y publicar snapshots periódicos de infraestructura maliciosa en América Latina, con énfasis en sistemas de comando y control (C2) y tooling asociado.

• Generated: 2026-06-10T17:16:22Z
• About ZOLIM: Español - English
• Current snapshot: link a github

Metrics (current)

IPs: 187

Unique ports: 39

Threat frameworks: 13

Countries: 14

Cities: 56

ASNs: 78

Tops (current)

• Threats: GoPhish(112) Quasar(21) Sliver(18) DCRat(9) Havoc(9) AsyncRAT(8) Cobalt Strike(5) CHAOS(5) Hack5 Cloud C2(4) Metasploit(4) Mythic(1) njRat(1)
• Countries: Brazil(95) Colombia(28) Mexico(15) Chile(13) Peru(11) Argentina(11) Panama(3) Paraguay(3) Honduras(2) Venezuela, Bolivarian Republic of(2) El Salvador(1) Costa Rica(1)
• Cities: São Paulo(65) Lima(11) Santiago(8) Valledupar(8) Barranquilla(7) Buenos Aires(6) Campinas(5) Rosario(5) Radica(4) Bucaramanga(4) Girón(4) Panamá(3)
• ASNs: 31898(19) 3816(16) 16509(12) 8075(9) 27831(7) 396982(6) 47583(6) 27823(5) 63949(4) 138915(4) 52368(4) 53107(3)
• ISPs: ORACLE-BMC-31898 - Oracle Corporation(17) AMAZON-02 - Amazon.com, Inc.(10) COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(10) AS-HOSTINGER(6) AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(6) GOOGLE-CLOUD-PLATFORM - Google LLC(5) Microsoft Corporation(5) Colombia Movil(4) MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation(4) Offshore Racks S.A(3) AS11014 - CPS(3) TELEFONICA BRASIL S.A(3)
• Orgs: unknown(135) Microsoft Corporation(5) Offshore Racks S.A(2) Oracle Corporation(2) ATPlus Telecom(2) TELEFÔNICA BRASIL S.A(2) Amazon Data Services Brazil(2) Linode(2) ZAM LTDA.(2) Kaopu Cloud HK Limited(2) Nw3 telecomunicações Ltda(2) Colombia Móvil(1)
• Ports (frequency across IPs): 3333(57) 443(30) 31337(17) 8080(16) 80(13) 9090(8) 8443(6) 8848(5) 6000(4) 3790(4) 9000(3) 43333(3)

Graphs (current)

---
config:  
 theme: dark  
---
pie title Threats
  "GoPhish" : 112
  "Quasar" : 21
  "Sliver" : 18
  "DCRat" : 9
  "Havoc" : 9
  "AsyncRAT" : 8
  "Cobalt Strike" : 5
  "CHAOS" : 5
  "Hack5 Cloud C2" : 4
  "Metasploit" : 4
  "Mythic" : 1
  "njRat" : 1

---  
config:  
 theme: dark  
--- 
pie title Countries
  "Brazil" : 95
  "Colombia" : 28
  "Mexico" : 15
  "Chile" : 13
  "Peru" : 11
  "Argentina" : 11
  "Panama" : 3
  "Paraguay" : 3
  "Honduras" : 2
  "Venezuela, Bolivarian Republic of" : 2
  "El Salvador" : 1
  "Costa Rica" : 1

---  
config:  
 theme: dark  
--- 
pie title ASNs
  "31898" : 19
  "3816" : 16
  "16509" : 12
  "8075" : 9
  "27831" : 7
  "396982" : 6
  "47583" : 6
  "27823" : 5
  "63949" : 4
  "138915" : 4
  "52368" : 4
  "53107" : 3

---  
config:  
 theme: dark  
--- 
pie title ISPs
  "ORACLE-BMC-31898 - Oracle Corporation" : 17
  "AMAZON-02 - Amazon.com, Inc." : 10
  "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 10
  "AS-HOSTINGER" : 6
  "AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 6
  "GOOGLE-CLOUD-PLATFORM - Google LLC" : 5
  "Microsoft Corporation" : 5
  "Colombia Movil" : 4
  "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation" : 4
  "Offshore Racks S.A" : 3
  "AS11014 - CPS" : 3
  "TELEFONICA BRASIL S.A" : 3

Country → Threat (top)

---  
config:  
 theme: dark  
--- 
%% Country → Threat (top)
sankey-beta
  Brazil,GoPhish,48
  Colombia,GoPhish,15
  Brazil,Sliver,14
  Mexico,GoPhish,12
  Chile,GoPhish,12
  Brazil,Quasar,11
  Argentina,GoPhish,9
  Colombia,DCRat,8
  Peru,GoPhish,8
  Colombia,AsyncRAT,6
  Brazil,Havoc,6
  Brazil,Cobalt Strike,4
  Paraguay,GoPhish,3
  Brazil,Metasploit,3
  Brazil,Hack5 Cloud C2,2
  Chile,Quasar,2
  Panama,GoPhish,2
  Mexico,Quasar,2
  Colombia,Quasar,2
  Peru,Havoc,2
  Brazil,AsyncRAT,2
  Peru,CHAOS,2
  Brazil,CHAOS,2
  Brazil,Mythic,1
  Mexico,Sliver,1
  Panama,Sliver,1
  Peru,Quasar,1
  El Salvador,GoPhish,1
  Costa Rica,GoPhish,1
  Ecuador,GoPhish,1

ASN → Threat (top)

---  
config:  
 theme: dark  
--- 
%% ASN → Threat (top)
sankey-beta
  31898,GoPhish,15
  3816,GoPhish,11
  27831,DCRat,6
  396982,GoPhish,6
  16509,GoPhish,6
  52368,GoPhish,6
  3816,AsyncRAT,5
  8075,GoPhish,4
  27823,GoPhish,4
  12252,GoPhish,3
  11014,GoPhish,3
  3132,GoPhish,3
  271239,GoPhish,3
  16509,Quasar,3
  47583,GoPhish,3
  138915,CHAOS,3
  270564,Quasar,2
  15830,GoPhish,2
  16735,GoPhish,2
  23201,GoPhish,2
  53107,GoPhish,2
  28343,GoPhish,2
  138915,Sliver,2
  52469,GoPhish,2
  47583,Quasar,2
  11172,Quasar,2
  31898,Quasar,2
  3816,DCRat,2
  18747,GoPhish,2
  267121,Sliver,2

Delta vs previous snapshot

• IPs: +12 / -0 (persistent: 175)
• Threat frameworks: +0 / -1
• Countries: +0 / -0
• ASNs: +2 / -0
• ISPs: +10 / -4
• Orgs: +2 / -5
• Ports: +0 / -1
• Cities: +2 / -1

Delta lists (compact)

• New IPs: 136.248.245.167, 138.36.238.226, 147.15.78.253, 152.254.155.35, 161.132.37.115, 163.176.38.132, 186.169.71.201, 190.20.96.35, 190.66.88.195, 200.10.113.124, 200.28.135.130, 200.33.163.61
• Removed IPs: none
• New threats: none
• Removed threats: UnamWebPanel
• New countries: none
• New ASNs: 10834, 272336
• New ISPs: AS10834 - Telefonica de Argentina, AS265451 - INFOLINK TELECOM, AS271814 - NEXTNET SAC, AS27699 - TELEFONICA BRASIL S.A, AS27823 - Dattatec.com, AS28137 - Vialink Solucoes de Tecnologia Ltda, AS52601 - BIZZ INTERNET LTDA, AS7418 - TELEFONICA CHILE S.A., Secretaría de Relaciones Exteriores, TELEFÓNICA CHILE S.A.
• New ports: none

IP reuse / threat drift

• IPs with threat changes: 1
  • 177.124.72.24: [‘Sliver’, ‘UnamWebPanel’] → [‘Sliver’] (+[], -[‘UnamWebPanel’])

Delta graph: NEW Country → Threat edges

---  
config:  
 theme: dark  
--- 
%% Δ Country → Threat (new edges)
sankey-beta
  Chile,Hack5 Cloud C2,1

Delta graph: NEW ASN → Threat edges

---  
config:  
 theme: dark  
--- 
%% Δ ASN → Threat (new edges)
sankey-beta
  31898,Sliver,1
  7418,Hack5 Cloud C2,1
  10834,GoPhish,1
  27699,Hack5 Cloud C2,1
  7418,GoPhish,1
  272336,GoPhish,1

All IPs (current snapshot)

Current snapshot link: https://github.com/ZoqueLabs/olim_datasets/tree/main/reports/2026-06-10_19-16-22