ZOLIM - Zoque-Observatorio de Infraestructura Maliciosa

ZOLIM (Observatorio Latinoamericano de Infraestructura Maliciosa de Zoque) es una iniciativa de investigación de ZoqueLabs orientada a documentar, analizar y publicar snapshots periódicos de infraestructura maliciosa en América Latina, con énfasis en sistemas de comando y control (C2) y tooling asociado.

• Generated: 2026-02-05T17:12:30Z
• About ZOLIM: Español - English
• Current snapshot: https://github.com/ZoqueLabs/olim_datasets/tree/main/reports/2026-02-05_12-12-30

Metrics (current)

IPs: 77

Unique ports: 24

Threat frameworks: 14

Countries: 13

Cities: 32

ASNs: 44

Tops (current)

• Threats: GoPhish(53) Sliver(8) DCRat(5) Cobalt Strike(4) Quasar(4) CHAOS(3) Havoc(2) AsyncRAT(1) UnamWebPanel(1) Mythic(1) Hack5 Cloud C2(1) njRat(1)
• Countries: Brazil(38) Colombia(7) Mexico(7) Peru(7) Argentina(4) Chile(4) Paraguay(3) Venezuela, Bolivarian Republic of(2) Panama(1) El Salvador(1) Costa Rica(1) Ecuador(1)
• Cities: São Paulo(25) Lima(7) Barranquilla(4) Santiago(4) Belo Horizonte(3) Asunción(3) Buenos Aires(3) Rolândia(2) Mexico City(2) Santiago de Querétaro(2) La Cañada(1) Panamá(1)
• ASNs: 31898(7) 8075(5) 27831(4) 63949(4) 16509(3) 11014(3) 271239(3) 396982(3) 53107(2) 270564(2) 12252(2) 15830(2)
• ISPs: ORACLE-BMC-31898 - Oracle Corporation(5) Colombia Movil(4) Microsoft Corporation(4) CPS(3) Altatech Solucoes em Tecnologia EIRELI(3) EVEO S.A.(2) Oracle Corporation(2) MASTER DA WEB DATACENTER LTDA(2) AKAMAI-LINODE-AP Akamai Connected Cloud(2) America Movil Peru S.A.C.(2) EQUINIX(2) Telecel S.A.(2)
• Orgs: unknown(47) Microsoft Corporation(4) America Movil Peru S.A.C.(2) Linode(2) ZAM LTDA.(2) FAXT TELECOMUNICACOES LTDA(1) Oracle Public Cloud(1) Equinix Services, Inc.(1) GLOBAL CONNECTIVITY SOLUTIONS LLP(1) Offshore Racks S.A(1) Univ. Catolica Nuestra Senora de la Asuncion(1) DIGICEL S.A. DE C.V.(1)
• Ports (frequency across IPs): 3333(28) 443(13) 31337(8) 8080(5) 80(5) 8848(3) 8443(3) 43333(3) 1080(2) 8081(2) 1000(1) 10035(1)

Graphs (current)

---
config:
  theme: dark
---
pie title Threats
  "GoPhish" : 53
  "Sliver" : 8
  "DCRat" : 5
  "Cobalt Strike" : 4
  "Quasar" : 4
  "CHAOS" : 3
  "Havoc" : 2
  "AsyncRAT" : 1
  "UnamWebPanel" : 1
  "Mythic" : 1
  "Hack5 Cloud C2" : 1
  "njRat" : 1

---
config:
  theme: dark
---
pie title Countries
  "Brazil" : 38
  "Colombia" : 7
  "Mexico" : 7
  "Peru" : 7
  "Argentina" : 4
  "Chile" : 4
  "Paraguay" : 3
  "Venezuela, Bolivarian Republic of" : 2
  "Panama" : 1
  "El Salvador" : 1
  "Costa Rica" : 1
  "Ecuador" : 1

---
config:
  theme: dark
---
pie title ASNs
  "31898" : 7
  "8075" : 5
  "27831" : 4
  "63949" : 4
  "16509" : 3
  "11014" : 3
  "271239" : 3
  "396982" : 3
  "53107" : 2
  "270564" : 2
  "12252" : 2
  "15830" : 2

---
config:
  theme: dark
---
pie title ISPs
  "ORACLE-BMC-31898 - Oracle Corporation" : 5
  "Colombia Movil" : 4
  "Microsoft Corporation" : 4
  "CPS" : 3
  "Altatech Solucoes em Tecnologia EIRELI" : 3
  "EVEO S.A." : 2
  "Oracle Corporation" : 2
  "MASTER DA WEB DATACENTER LTDA" : 2
  "AKAMAI-LINODE-AP Akamai Connected Cloud" : 2
  "America Movil Peru S.A.C." : 2
  "EQUINIX" : 2
  "Telecel S.A." : 2

Country → Threat (top)

---
config:
  theme: dark
---
%% Country → Threat (top)
sankey-beta
  Brazil,GoPhish,21
  Mexico,GoPhish,6
  Peru,GoPhish,6
  Chile,GoPhish,6
  Colombia,DCRat,5
  Brazil,Sliver,4
  Argentina,GoPhish,4
  Brazil,Cobalt Strike,3
  Paraguay,GoPhish,3
  Brazil,Quasar,2
  Brazil,Havoc,2
  El Salvador,GoPhish,2
  Costa Rica,GoPhish,2
  Colombia,GoPhish,2
  Peru,CHAOS,2
  Colombia,AsyncRAT,1
  Brazil,UnamWebPanel,1
  Brazil,Mythic,1
  Brazil,Hack5 Cloud C2,1
  Mexico,Sliver,1
  Panama,Sliver,1
  Peru,Quasar,1
  Ecuador,GoPhish,1
  Venezuela  Bolivarian Republic of,Cobalt Strike,1
  Chile,Sliver,1
  Brazil,njRat,1
  Brazil,CHAOS,1
  Brazil,Metasploit,1
  Uruguay,Sliver,1
  Venezuela  Bolivarian Republic of,Quasar,1

ASN → Threat (top)

---
config:
  theme: dark
---
%% ASN → Threat (top)
sankey-beta
  31898,GoPhish,6
  27831,DCRat,4
  396982,GoPhish,4
  52368,GoPhish,4
  12252,GoPhish,3
  11014,GoPhish,3
  271239,GoPhish,3
  270564,Quasar,2
  15830,GoPhish,2
  23201,GoPhish,2
  174,GoPhish,2
  3132,GoPhish,2
  8075,GoPhish,2
  262197,GoPhish,2
  8075,Sliver,2
  138915,CHAOS,2
  53107,Cobalt Strike,1
  27831,AsyncRAT,1
  52601,Sliver,1
  52601,UnamWebPanel,1
  16509,Mythic,1
  31898,Hack5 Cloud C2,1
  54825,Sliver,1
  215540,Sliver,1
  52469,Sliver,1
  27843,Quasar,1
  63949,Havoc,1
  28137,GoPhish,1
  16735,GoPhish,1
  271366,GoPhish,1

Delta vs previous snapshot

• IPs: +14 / -1 (persistent: 63)
• Threat frameworks: +1 / -0
• Countries: +0 / -0
• ASNs: +5 / -0
• ISPs: +10 / -3
• Orgs: +4 / -1
• Ports: +4 / -1
• Cities: +7 / -2

Delta lists (compact)

• New IPs: 152.203.25.225, 172.233.15.195, 177.126.168.209, 186.169.55.212, 187.168.236.220, 191.93.117.34, 200.109.21.86, 200.58.100.246, 34.51.42.9, 34.51.56.27, 4.201.220.7, 45.225.129.210, 54.233.43.28, 64.76.214.54
• Removed IPs: 186.17.213.66
• New threats: Supershell
• Removed threats: none
• New countries: none
• New ASNs: 27823, 3549, 3816, 8048, 8151
• New ISPs: ALTVIA TECNOLOGIA E SERVICOS DIGITAIS LTDA, AMAZON-02 - Amazon.com, Inc., CANTV Servicios, Venezuela, COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, Dattatec.com, GOOGLE-CLOUD-PLATFORM - Google LLC, LVLT-3549 - Level 3 Parent, LLC, MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, ORACLE-BMC-31898 - Oracle Corporation, UNINET
• New ports: 3334, 8888, 9002, 953

IP reuse / threat drift

• IPs with threat changes: 1
  • 177.124.72.24: [‘Havoc’, ‘Sliver’, ‘UnamWebPanel’] → [‘Sliver’, ‘UnamWebPanel’] (+[], -[‘Havoc’])

Delta graph: NEW Country → Threat edges

---
config:
  theme: dark
---
%% Δ Country → Threat (new edges)
sankey-beta
  Colombia,GoPhish,2
  Venezuela  Bolivarian Republic of,Quasar,1
  Brazil,Supershell,1

Delta graph: NEW ASN → Threat edges

---
config:
  theme: dark
---
%% Δ ASN → Threat (new edges)
sankey-beta
  16509,GoPhish,1
  3549,GoPhish,1
  8151,GoPhish,1
  27823,GoPhish,1
  3816,GoPhish,1
  3816,DCRat,1
  8075,Cobalt Strike,1
  8048,Quasar,1
  63949,Supershell,1

All IPs (current snapshot)

Current snapshot link: https://github.com/ZoqueLabs/olim_datasets/tree/main/reports/2026-02-05_12-12-30