ZOLIM - Zoque-Observatorio Latinoamericano de Infraestructura Malicios

ZOLIM (Observatorio Latinoamericano de Infraestructura Maliciosa de Zoque) es una iniciativa de investigación de ZoqueLabs orientada a documentar, analizar y publicar snapshots periódicos de infraestructura maliciosa en América Latina, con énfasis en sistemas de comando y control (C2) y tooling asociado.

• Generated: 2026-03-05T17:50:39Z
• Current snapshot: https://github.com/ZoqueLabs/olim_datasets/tree/main/reports/2026-03-05_12-50-39
• About ZOLIM: Español - English

Metrics (current)

IPs: 104

Unique ports: 33

Threat frameworks: 14

Countries: 14

Cities: 38

ASNs: 51

Tops (current)

• Threats: GoPhish(60) Quasar(18) Sliver(10) DCRat(7) Cobalt Strike(4) CHAOS(4) Havoc(3) AsyncRAT(1) UnamWebPanel(1) Mythic(1) Hack5 Cloud C2(1) njRat(1)
• Countries: Brazil(54) Colombia(9) Mexico(8) Peru(7) Chile(7) Argentina(6) Panama(3) Paraguay(3) Venezuela, Bolivarian Republic of(2) El Salvador(1) Costa Rica(1) Ecuador(1)
• Cities: São Paulo(41) Lima(7) Barranquilla(5) Santiago(5) Buenos Aires(4) Belo Horizonte(3) Panamá(3) Asunción(2) Rolândia(2) Mexico City(2) Santiago de Querétaro(2) Rosario(2)
• ASNs: 31898(11) 16509(7) 27831(5) 8075(5) 63949(4) 138915(4) 53107(3) 52469(3) 11014(3) 271239(3) 396982(3) 47583(3)
• ISPs: ORACLE-BMC-31898 - Oracle Corporation(8) AMAZON-02 - Amazon.com, Inc.(6) Colombia Movil(5) Microsoft Corporation(4) EVEO S.A.(3) Offshore Racks S.A(3) CPS(3) TELEFONICA BRASIL S.A(3) Altatech Solucoes em Tecnologia EIRELI(3) Oracle Corporation(3) AS-HOSTINGER(3) Kaopu Cloud HK Limited(3)
• Orgs: unknown(69) Microsoft Corporation(4) Offshore Racks S.A(3) Oracle Corporation(3) Linode(2) ZAM LTDA.(2) Kaopu Cloud HK Limited(2) FAXT TELECOMUNICACOES LTDA(1) Equinix Services, Inc.(1) GLOBAL CONNECTIVITY SOLUTIONS LLP(1) Univ. Catolica Nuestra Senora de la Asuncion(1) DIGICEL S.A. DE C.V.(1)
• Ports (frequency across IPs): 3333(31) 443(18) 31337(9) 8080(9) 80(7) 8848(4) 9000(3) 8443(3) 43333(3) 1080(2) 8081(2) 1000(1)

Graphs (current)

---
config:
  theme: dark
---
pie title Threats
  "GoPhish" : 60
  "Quasar" : 18
  "Sliver" : 10
  "DCRat" : 7
  "Cobalt Strike" : 4
  "CHAOS" : 4
  "Havoc" : 3
  "AsyncRAT" : 1
  "UnamWebPanel" : 1
  "Mythic" : 1
  "Hack5 Cloud C2" : 1
  "njRat" : 1

---
config:
  theme: dark
---
pie title Countries
  "Brazil" : 54
  "Colombia" : 9
  "Mexico" : 8
  "Peru" : 7
  "Chile" : 7
  "Argentina" : 6
  "Panama" : 3
  "Paraguay" : 3
  "Venezuela, Bolivarian Republic of" : 2
  "El Salvador" : 1
  "Costa Rica" : 1
  "Ecuador" : 1

---
config:
  theme: dark
---
pie title ASNs
  "31898" : 11
  "16509" : 7
  "27831" : 5
  "8075" : 5
  "63949" : 4
  "138915" : 4
  "53107" : 3
  "52469" : 3
  "11014" : 3
  "271239" : 3
  "396982" : 3
  "47583" : 3

---
config:
  theme: dark
---
pie title ISPs
  "ORACLE-BMC-31898 - Oracle Corporation" : 8
  "AMAZON-02 - Amazon.com, Inc." : 6
  "Colombia Movil" : 5
  "Microsoft Corporation" : 4
  "EVEO S.A." : 3
  "Offshore Racks S.A" : 3
  "CPS" : 3
  "TELEFONICA BRASIL S.A" : 3
  "Altatech Solucoes em Tecnologia EIRELI" : 3
  "Oracle Corporation" : 3
  "AS-HOSTINGER" : 3
  "Kaopu Cloud HK Limited" : 3

Country → Threat (top)

---
config:
  theme: dark
---
%% Country → Threat (top)
sankey-beta
  Brazil,GoPhish,24
  Brazil,Quasar,10
  Chile,GoPhish,7
  Colombia,DCRat,6
  Brazil,Sliver,6
  Mexico,GoPhish,6
  Peru,GoPhish,6
  Argentina,GoPhish,6
  Brazil,Cobalt Strike,3
  Brazil,Havoc,3
  Paraguay,GoPhish,3
  El Salvador,GoPhish,2
  Colombia,GoPhish,2
  Chile,Quasar,2
  Panama,GoPhish,2
  Mexico,Quasar,2
  Peru,CHAOS,2
  Brazil,CHAOS,2
  Colombia,AsyncRAT,1
  Brazil,UnamWebPanel,1
  Brazil,Mythic,1
  Brazil,Hack5 Cloud C2,1
  Mexico,Sliver,1
  Panama,Sliver,1
  Peru,Quasar,1
  Costa Rica,GoPhish,1
  Ecuador,GoPhish,1
  Brazil,DCRat,1
  Honduras,Quasar,1
  Colombia,Quasar,1

ASN → Threat (top)

---
config:
  theme: dark
---
%% ASN → Threat (top)
sankey-beta
  31898,GoPhish,7
  27831,DCRat,5
  396982,GoPhish,4
  52368,GoPhish,4
  12252,GoPhish,3
  11014,GoPhish,3
  271239,GoPhish,3
  16509,Quasar,3
  138915,CHAOS,3
  270564,Quasar,2
  15830,GoPhish,2
  23201,GoPhish,2
  174,GoPhish,2
  53107,GoPhish,2
  3132,GoPhish,2
  8075,GoPhish,2
  16509,GoPhish,2
  27823,GoPhish,2
  138915,Sliver,2
  52469,GoPhish,2
  47583,Quasar,2
  11172,Quasar,2
  31898,Quasar,2
  8075,Sliver,2
  53107,Cobalt Strike,1
  27831,AsyncRAT,1
  52601,Sliver,1
  52601,UnamWebPanel,1
  16509,Mythic,1
  31898,Hack5 Cloud C2,1

Delta vs previous snapshot

• IPs: +17 / -0 (persistent: 87)
• Threat frameworks: +0 / -0
• Countries: +1 / -0
• ASNs: +4 / -0
• ISPs: +5 / -2
• Orgs: +1 / -3
• Ports: +4 / -2
• Cities: +4 / -2

Delta lists (compact)

• New IPs: 149.130.165.200, 168.138.131.15, 177.104.188.108, 179.151.242.232, 18.231.78.171, 181.174.165.127, 190.14.57.229, 191.93.118.190, 200.225.247.79, 201.234.38.193, 207.248.247.66, 38.60.209.204, 45.67.247.185, 54.94.39.204, 56.125.168.86, 89.116.186.136, 89.116.186.72
• Removed IPs: none
• New threats: none
• Removed threats: none
• New countries: Honduras
• New ASNs: 11172, 21756, 273189, 27659
• New ISPs: Alestra, S. de R.L. de C.V., CA NETWORK S.A. DE C.V., Ingenieria e Informatica Asociada Ltda IIA Ltda, LVLT-3549 - Level 3 Parent, LLC, SIDERCA S.A.I.C.
• New ports: 1337, 8002, 8003, 9090

IP reuse / threat drift

• IPs with threat changes: 1
  • 191.93.118.254: [‘AsyncRAT’] → [‘AsyncRAT’, ‘DCRat’] (+[‘DCRat’], -[])

Delta graph: NEW Country → Threat edges

---
config:
  theme: dark
---
%% Δ Country → Threat (new edges)
sankey-beta
  Mexico,Quasar,2
  Honduras,Quasar,1
  Colombia,Quasar,1

Delta graph: NEW ASN → Threat edges

---
config:
  theme: dark
---
%% Δ ASN → Threat (new edges)
sankey-beta
  16509,Quasar,3
  47583,Quasar,2
  11172,Quasar,2
  31898,Quasar,2
  27659,Quasar,1
  273189,Quasar,1
  16735,Quasar,1
  26599,GoPhish,1
  21756,GoPhish,1

All IPs (current snapshot)

Current snapshot link: https://github.com/ZoqueLabs/olim_datasets/tree/main/reports/2026-03-05_12-50-39