ZOLIM - Zoque-Observatorio Latinoamericano de Infraestructura Maliciosa

ZOLIM (Observatorio Latinoamericano de Infraestructura Maliciosa de Zoque) es una iniciativa de investigación de ZoqueLabs orientada a documentar, analizar y publicar snapshots periódicos de infraestructura maliciosa en América Latina, con énfasis en sistemas de comando y control (C2) y tooling asociado.

• Generated: 2026-05-29T19:55:14Z
• About ZOLIM: Español - English
• Current snapshot: Archivos en GitHub

Metrics (current)

IPs: 175

Unique ports: 40

Threat frameworks: 14

Countries: 14

Cities: 55

ASNs: 76

Tops (current)

• Threats: GoPhish(103) Quasar(21) Sliver(17) DCRat(9) Havoc(9) AsyncRAT(7) Cobalt Strike(5) CHAOS(5) Metasploit(4) Hack5 Cloud C2(2) UnamWebPanel(1) Mythic(1)
• Countries: Brazil(92) Colombia(26) Mexico(14) Peru(10) Chile(10) Argentina(9) Panama(3) Paraguay(3) Honduras(2) Venezuela, Bolivarian Republic of(2) El Salvador(1) Costa Rica(1)
• Cities: São Paulo(62) Lima(10) Barranquilla(7) Valledupar(7) Santiago(6) Buenos Aires(5) Campinas(5) Radica(4) Rosario(4) Bucaramanga(4) Belo Horizonte(3) Panamá(3)
• ASNs: 31898(16) 3816(14) 16509(12) 8075(9) 27831(7) 396982(6) 47583(6) 63949(4) 27823(4) 138915(4) 52368(4) 53107(3)
• ISPs: ORACLE-BMC-31898 - Oracle Corporation(13) AMAZON-02 - Amazon.com, Inc.(10) COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(10) AS-HOSTINGER(6) Microsoft Corporation(5) Colombia Movil(4) MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation(4) GOOGLE-CLOUD-PLATFORM - Google LLC(4) Dattatec.com(4) AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(4) Oracle Corporation(3) Offshore Racks S.A(3)
• Orgs: unknown(118) Microsoft Corporation(5) Offshore Racks S.A(2) Google LLC(2) Oracle Corporation(2) ATPlus Telecom(2) TELEFÔNICA BRASIL S.A(2) Dattatec Corp(2) Amazon Data Services Brazil(2) Linode(2) ZAM LTDA.(2) Kaopu Cloud HK Limited(2)
• Ports (frequency across IPs): 3333(49) 443(30) 31337(16) 8080(15) 80(13) 9090(7) 8848(5) 8443(5) 3790(4) 9000(3) 43333(3) 8081(3)

Graphs (current)

---
config:
  theme: dark
---
pie title Threats
  "GoPhish" : 103
  "Quasar" : 21
  "Sliver" : 17
  "DCRat" : 9
  "Havoc" : 9
  "AsyncRAT" : 7
  "Cobalt Strike" : 5
  "CHAOS" : 5
  "Metasploit" : 4
  "Hack5 Cloud C2" : 2
  "UnamWebPanel" : 1
  "Mythic" : 1

---
config:
  theme: dark
---
pie title Countries
  "Brazil" : 92
  "Colombia" : 26
  "Mexico" : 14
  "Peru" : 10
  "Chile" : 10
  "Argentina" : 9
  "Panama" : 3
  "Paraguay" : 3
  "Honduras" : 2
  "Venezuela, Bolivarian Republic of" : 2
  "El Salvador" : 1
  "Costa Rica" : 1

---
config:
  theme: dark
---
pie title ASNs
  "31898" : 16
  "3816" : 14
  "16509" : 12
  "8075" : 9
  "27831" : 7
  "396982" : 6
  "47583" : 6
  "63949" : 4
  "27823" : 4
  "138915" : 4
  "52368" : 4
  "53107" : 3

---
config:
  theme: dark
---
pie title ISPs
  "ORACLE-BMC-31898 - Oracle Corporation" : 13
  "AMAZON-02 - Amazon.com, Inc." : 10
  "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 10
  "AS-HOSTINGER" : 6
  "Microsoft Corporation" : 5
  "Colombia Movil" : 4
  "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation" : 4
  "GOOGLE-CLOUD-PLATFORM - Google LLC" : 4
  "Dattatec.com" : 4
  "AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 4
  "Oracle Corporation" : 3
  "Offshore Racks S.A" : 3

Country → Threat (top)

---
config:
  theme: dark
---
%% Country → Threat (top)
sankey-beta
  Brazil,GoPhish,46
  Colombia,GoPhish,14
  Brazil,Sliver,13
  Brazil,Quasar,11
  Mexico,GoPhish,11
  Chile,GoPhish,10
  Colombia,DCRat,8
  Peru,GoPhish,7
  Argentina,GoPhish,7
  Brazil,Havoc,6
  Colombia,AsyncRAT,5
  Brazil,Cobalt Strike,4
  Paraguay,GoPhish,3
  Brazil,Metasploit,3
  Chile,Quasar,2
  Panama,GoPhish,2
  Mexico,Quasar,2
  Colombia,Quasar,2
  Peru,Havoc,2
  Brazil,AsyncRAT,2
  Peru,CHAOS,2
  Brazil,CHAOS,2
  Brazil,UnamWebPanel,1
  Brazil,Mythic,1
  Brazil,Hack5 Cloud C2,1
  Mexico,Sliver,1
  Panama,Sliver,1
  Peru,Quasar,1
  El Salvador,GoPhish,1
  Costa Rica,GoPhish,1

ASN → Threat (top)

---
config:
  theme: dark
---
%% ASN → Threat (top)
sankey-beta
  31898,GoPhish,12
  3816,GoPhish,10
  27831,DCRat,6
  396982,GoPhish,6
  16509,GoPhish,6
  52368,GoPhish,6
  8075,GoPhish,4
  3816,AsyncRAT,4
  12252,GoPhish,3
  11014,GoPhish,3
  271239,GoPhish,3
  27823,GoPhish,3
  16509,Quasar,3
  47583,GoPhish,3
  138915,CHAOS,3
  270564,Quasar,2
  15830,GoPhish,2
  16735,GoPhish,2
  23201,GoPhish,2
  53107,GoPhish,2
  3132,GoPhish,2
  28343,GoPhish,2
  138915,Sliver,2
  52469,GoPhish,2
  47583,Quasar,2
  11172,Quasar,2
  31898,Quasar,2
  3816,DCRat,2
  18747,GoPhish,2
  267121,Sliver,2

Delta vs previous snapshot

• IPs: +11 / -0 (persistent: 164)
• Threat frameworks: +0 / -0
• Countries: +0 / -0
• ASNs: +5 / -0
• ISPs: +24 / -9
• Orgs: +9 / -1
• Ports: +1 / -1
• Cities: +6 / -1

Delta lists (compact)

• New IPs: 181.236.210.75, 181.32.35.253, 190.84.81.7, 191.93.116.106, 20.206.249.20, 200.57.165.148, 216.238.121.111, 216.238.75.34, 34.176.98.184, 38.187.1.77, 77.111.101.101
• Removed IPs: none
• New threats: none
• Removed threats: none
• New countries: none
• New ASNs: 19373, 20473, 271814, 396356, Not Found
• New ISPs: AKAMAI-LINODE-AP - Akamai Connected Cloud, AS-VULTR - The Constant Company, LLC, AS11014 - CPS, AS12252 - America Movil Peru S.A.C., AS13579 - INFOTEC CENTRO DE INVESTIGACION E INNOVACION EN TECNOLOGIAS DE LA INFORMACION Y COMUNICACION, AS14868 - Ligga Telecomunicacoes S.A., AS16735 - ALGAR TELECOM S/A, AS265621 - COMUNICACION DIGITAL DE SINALOA SA DE CV, AS271366 - ALTVIA TECNOLOGIA E SERVICOS DIGITAIS LTDA, AS27831 - Colombia Movil, AS28343 - UNIFIQUE TELECOMUNICACOES S/A, AS3132 - Red Cientifica Peruana, AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, AS52368 - ZAM LTDA., AS52721 - TOLEDO FIBRA TELECOMUNICACAO LTDA, AS53107 - EVEO S.A., Colombia Móvil, Equinix - Equinix (EMEA) Acquisition Enterprises B.V., Latitude.sh, Level 3 Parent, LLC, NEXTNET SAC, Triara.com S.A. de C.V., Vialink Soluções de Tecnologia Ltda, unknown
• New ports: 16004

IP reuse / threat drift

• IPs with threat changes: 1
  • 191.93.118.254: [‘DCRat’] → [‘AsyncRAT’] (+[‘AsyncRAT’], -[‘DCRat’])

Delta graph: NEW Country → Threat edges

---
config:
  theme: dark
---
%% Δ Country → Threat (new edges)
sankey-beta
  Mexico,Havoc,1

Delta graph: NEW ASN → Threat edges

---
config:
  theme: dark
---
%% Δ ASN → Threat (new edges)
sankey-beta
  27831,AsyncRAT,1
  20473,Havoc,1
  20473,GoPhish,1
  271814,GoPhish,1
  396356,Sliver,1
  19373,GoPhish,1
  Not Found,GoPhish,1

All IPs (current snapshot)

Current snapshot link: https://github.com/ZoqueLabs/olim_datasets/tree/main/reports/2026-05-29_14-55-14