ZOLIM - Zoque-Observatorio Latinoamericano de Infraestructura Maliciosa

ZOLIM (Observatorio Latinoamericano de Infraestructura Maliciosa de Zoque) es una iniciativa de investigación de ZoqueLabs orientada a documentar, analizar y publicar snapshots periódicos de infraestructura maliciosa en América Latina, con énfasis en sistemas de comando y control (C2) y tooling asociado.

• Generated: 2026-09-17T21:42:46Z
• Current snapshot: En GitLab
• About ZOLIM: Español - English

Metrics (current)

• IPs: 272

  Unique ports: 52

  Threat frameworks: 14

  Countries: 14

  Cities: 73

  ASNs: 98

Tops (current)

• Threats: GoPhish(164) Sliver(28) Quasar(27) AsyncRAT(16) Havoc(14) DCRat(12) Hack5 Cloud C2(10) Cobalt Strike(6) CHAOS(6) Metasploit(4) UnamWebPanel(1) Mythic(1)
• Countries: Brazil(122) Colombia(49) Chile(32) Mexico(24) Argentina(14) Peru(12) Panama(4) Venezuela, Bolivarian Republic of(4) Paraguay(3) Costa Rica(2) Ecuador(2) Honduras(2)
• Cities: São Paulo(80) Santiago(25) Valledupar(14) Lima(12) Bucaramanga(11) Barranquilla(9) Buenos Aires(7) Campinas(7) Mexico City(5) Rosario(5) Girón(5) Belo Horizonte(4)
• ASNs: 3816(32) 31898(23) 7418(17) 16509(14) 8075(9) 396982(7) 47583(7) 27831(6) 27823(6) 16735(5) 8151(5) 52368(5)
• ISPs: AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(22) ORACLE-BMC-31898 - Oracle Corporation(19) AMAZON-02 - Amazon.com, Inc.(12) COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(10) TELEFÓNICA CHILE S.A.(9) AS7418 - TELEFONICA CHILE S.A.(7) GOOGLE-CLOUD-PLATFORM - Google LLC(6) AS-HOSTINGER(6) Microsoft Corporation(5) Colombia Movil(4) MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation(4) Oracle Corporation(4)
• Orgs: unknown(186) TELEFÓNICA CHILE S.A.(7) Microsoft Corporation(5) Oracle Corporation(4) TELEFÔNICA BRASIL S.A(3) ZAM LTDA.(3) Globenet Cabos Submarinos America Inc.(3) Uninet S.A. de C.V.(3) Offshore Racks S.A(2) Altatech Soluções em Tecnologia EIRELI(2) ATPlus Telecom(2) Amazon Data Services Brazil(2)
• Ports (frequency across IPs): 3333(91) 443(35) 31337(27) 8080(27) 80(13) 8443(13) 9090(9) 8848(5) 8081(5) 9000(4) 43333(4) 6000(4)

Graphs (current)

---  
config:  
 theme: dark  
---  
pie title Threats
  "GoPhish" : 164
  "Sliver" : 28
  "Quasar" : 27
  "AsyncRAT" : 16
  "Havoc" : 14
  "DCRat" : 12
  "Hack5 Cloud C2" : 10
  "Cobalt Strike" : 6
  "CHAOS" : 6
  "Metasploit" : 4
  "UnamWebPanel" : 1
  "Mythic" : 1

---  
config:  
 theme: dark  
---  
pie title Countries
  "Brazil" : 122
  "Colombia" : 49
  "Chile" : 32
  "Mexico" : 24
  "Argentina" : 14
  "Peru" : 12
  "Panama" : 4
  "Venezuela, Bolivarian Republic of" : 4
  "Paraguay" : 3
  "Costa Rica" : 2
  "Ecuador" : 2
  "Honduras" : 2

---  
config:  
 theme: dark  
---  
pie title ASNs
  "3816" : 32
  "31898" : 23
  "7418" : 17
  "16509" : 14
  "8075" : 9
  "396982" : 7
  "47583" : 7
  "27831" : 6
  "27823" : 6
  "16735" : 5
  "8151" : 5
  "52368" : 5

---  
config:  
 theme: dark  
---  
pie title ISPs
  "AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 22
  "ORACLE-BMC-31898 - Oracle Corporation" : 19
  "AMAZON-02 - Amazon.com, Inc." : 12
  "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 10
  "TELEFÓNICA CHILE S.A." : 9
  "AS7418 - TELEFONICA CHILE S.A." : 7
  "GOOGLE-CLOUD-PLATFORM - Google LLC" : 6
  "AS-HOSTINGER" : 6
  "Microsoft Corporation" : 5
  "Colombia Movil" : 4
  "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation" : 4
  "Oracle Corporation" : 4

Country → Threat (top)

---  
config:  
 theme: dark  
---  
%% Country → Threat (top)
sankey-beta
  Brazil,GoPhish,64
  Colombia,GoPhish,28
  Chile,GoPhish,24
  Brazil,Sliver,19
  Mexico,GoPhish,15
  Colombia,AsyncRAT,14
  Brazil,Quasar,12
  Argentina,GoPhish,12
  Brazil,Havoc,11
  Colombia,DCRat,9
  Peru,GoPhish,9
  Chile,Hack5 Cloud C2,7
  Mexico,Sliver,6
  Colombia,Quasar,6
  Brazil,Cobalt Strike,5
  Paraguay,GoPhish,3
  Mexico,Quasar,3
  Brazil,Metasploit,3
  Brazil,Hack5 Cloud C2,2
  Costa Rica,GoPhish,2
  Ecuador,GoPhish,2
  Brazil,DCRat,2
  Chile,Quasar,2
  Panama,GoPhish,2
  Peru,Havoc,2
  Brazil,AsyncRAT,2
  Peru,CHAOS,2
  Brazil,CHAOS,2
  Venezuela  Bolivarian Republic of,GoPhish,2
  Brazil,UnamWebPanel,1

ASN → Threat (top)

---  
config:  
 theme: dark  
---  
%% ASN → Threat (top)
sankey-beta
  3816,GoPhish,21
  31898,GoPhish,18
  3816,AsyncRAT,12
  7418,GoPhish,9
  396982,GoPhish,7
  16509,GoPhish,7
  52368,GoPhish,7
  7418,Hack5 Cloud C2,7
  27831,DCRat,5
  27823,GoPhish,5
  3816,Quasar,5
  16735,GoPhish,4
  3132,GoPhish,4
  271239,GoPhish,4
  8075,GoPhish,4
  12252,GoPhish,3
  15830,GoPhish,3
  11014,GoPhish,3
  16509,Quasar,3
  18747,GoPhish,3
  47583,GoPhish,3
  20473,GoPhish,3
  138915,CHAOS,3
  Not Found,Sliver,3
  13489,DCRat,2
  270564,Quasar,2
  23201,GoPhish,2
  53107,GoPhish,2
  28343,GoPhish,2
  8151,GoPhish,2

Delta vs previous snapshot

• IPs: +15 / -0 (persistent: 257)
• Threat frameworks: +0 / -0
• Countries: +0 / -0
• ASNs: +0 / -0
• ISPs: +9 / -8
• Orgs: +6 / -3
• Ports: +1 / -2
• Cities: +7 / -1

Delta lists (compact)

• New IPs: 163.176.60.81, 177.136.225.160, 179.199.198.208, 181.206.158.19, 181.235.13.254, 186.105.25.45, 186.116.169.133, 186.168.10.178, 187.145.61.38, 187.72.104.68, 189.24.79.40, 191.93.113.119, 201.189.55.90, 64.176.19.42, 76.13.165.226
• Removed IPs: none
• New threats: none
• Removed threats: none
• New countries: none
• New ASNs: none
• New ISPs: AS-HOSTINGER - Hostinger International Limited, AS265451 - INFOLINK TELECOM, AS7303 - Telecom Argentina S.A., Equinix (EMEA) Acquisition Enterprises B.V., INET Communication, Level 3 Parent, LLC, Saveincloud Hospedagem na Internet Ltda, VIETTEL PERÚ S.A.C., Vialink Soluções de Tecnologia Ltda
• New ports: 8112

IP reuse / threat drift

• No IP reuse / drift detected (between these two snapshots).

Delta graph: NEW ASN → Threat edges

---  
config:  
 theme: dark  
---  
%% Δ ASN → Threat (new edges)
sankey-beta
  53107,Sliver,1
  13489,AsyncRAT,1
  7738,GoPhish,1
  7738,Cobalt Strike,1

All IPs (current snapshot)

Current snapshot link: https://gitlab.com/zoquelabs/olim_datasets/-/tree/92964442bf15bcbb7b19d0b8e4c3da5046c95ea5/reports/2026-09-17_16-42-46