ZOLIM - Zoque-Observatorio Latinoamericano de Infraestructura Maliciosa

ZOLIM (Observatorio Latinoamericano de Infraestructura Maliciosa de Zoque) es una iniciativa de investigación de ZoqueLabs orientada a documentar, analizar y publicar snapshots periódicos de infraestructura maliciosa en América Latina, con énfasis en sistemas de comando y control (C2) y tooling asociado.

• Generated: 2026-08-07T16:06:30Z
• About ZOLIM: Español - English
• Current snapshot: En Gitlab

Metrics (current)

IPs: 232

Unique ports: 48

Threat frameworks: 13

Countries: 14

Cities: 68

ASNs: 91

Tops (current)

• Threats: GoPhish(142) Quasar(22) Sliver(21) AsyncRAT(14) Havoc(12) DCRat(11) Hack5 Cloud C2(7) CHAOS(7) Cobalt Strike(5) Metasploit(4) Mythic(1) njRat(1)
• Countries: Brazil(110) Colombia(39) Chile(22) Mexico(20) Argentina(13) Peru(11) Panama(4) Paraguay(3) Venezuela, Bolivarian Republic of(3) Costa Rica(2) Honduras(2) El Salvador(1)
• Cities: São Paulo(74) Santiago(15) Valledupar(12) Lima(11) Barranquilla(7) Bucaramanga(7) Rosario(6) Buenos Aires(5) Campinas(5) Mexico City(5) Radica(4) Girón(4)
• ASNs: 3816(25) 31898(20) 16509(14) 7418(10) 8075(9) 27831(7) 396982(7) 27823(6) 47583(6) 52368(5) 63949(4) 16735(4)
• ISPs: ORACLE-BMC-31898 - Oracle Corporation(17) AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(15) AMAZON-02 - Amazon.com, Inc.(12) COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(10) AS-HOSTINGER(6) AS7418 - TELEFONICA CHILE S.A.(6) GOOGLE-CLOUD-PLATFORM - Google LLC(5) Microsoft Corporation(5) Colombia Movil(4) MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation(4) ZAM LTDA.(4) Offshore Racks S.A(3)
• Orgs: unknown(162) Microsoft Corporation(5) Oracle Corporation(3) TELEFÔNICA BRASIL S.A(3) ZAM LTDA.(3) TELEFÓNICA CHILE S.A.(3) Offshore Racks S.A(2) Google LLC(2) ATPlus Telecom(2) Amazon Data Services Brazil(2) Linode(2) Kaopu Cloud HK Limited(2)
• Ports (frequency across IPs): 3333(76) 443(32) 8080(22) 31337(20) 80(13) 8443(10) 9090(9) 8848(5) 8081(5) 43333(4) 6000(4) 3790(4)

Graphs (current)

---
config:
  theme: dark
---
pie title Threats
  "GoPhish" : 142
  "Quasar" : 22
  "Sliver" : 21
  "AsyncRAT" : 14
  "Havoc" : 12
  "DCRat" : 11
  "Hack5 Cloud C2" : 7
  "CHAOS" : 7
  "Cobalt Strike" : 5
  "Metasploit" : 4
  "Mythic" : 1
  "njRat" : 1

---
config:
  theme: dark
---
pie title Countries
  "Brazil" : 110
  "Colombia" : 39
  "Chile" : 22
  "Mexico" : 20
  "Argentina" : 13
  "Peru" : 11
  "Panama" : 4
  "Paraguay" : 3
  "Venezuela, Bolivarian Republic of" : 3
  "Costa Rica" : 2
  "Honduras" : 2
  "El Salvador" : 1

---
config:
  theme: dark
---
pie title ASNs
  "3816" : 25
  "31898" : 20
  "16509" : 14
  "7418" : 10
  "8075" : 9
  "27831" : 7
  "396982" : 7
  "27823" : 6
  "47583" : 6
  "52368" : 5
  "63949" : 4
  "16735" : 4

---
config:
  theme: dark
---
pie title ISPs
  "ORACLE-BMC-31898 - Oracle Corporation" : 17
  "AS3816 - COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 15
  "AMAZON-02 - Amazon.com, Inc." : 12
  "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 10
  "AS-HOSTINGER" : 6
  "AS7418 - TELEFONICA CHILE S.A." : 6
  "GOOGLE-CLOUD-PLATFORM - Google LLC" : 5
  "Microsoft Corporation" : 5
  "Colombia Movil" : 4
  "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation" : 4
  "ZAM LTDA." : 4
  "Offshore Racks S.A" : 3

Country → Threat (top)

---
config:
  theme: dark
---
%% Country → Threat (top)
sankey-beta
  Brazil,GoPhish,59
  Colombia,GoPhish,22
  Chile,GoPhish,17
  Brazil,Sliver,15
  Mexico,GoPhish,15
  Colombia,AsyncRAT,12
  Brazil,Quasar,11
  Argentina,GoPhish,11
  Brazil,Havoc,9
  Colombia,DCRat,8
  Peru,GoPhish,8
  Brazil,Cobalt Strike,4
  Chile,Hack5 Cloud C2,4
  Mexico,Sliver,3
  Paraguay,GoPhish,3
  Colombia,Quasar,3
  Brazil,Metasploit,3
  Brazil,Hack5 Cloud C2,2
  Costa Rica,GoPhish,2
  Brazil,DCRat,2
  Chile,Quasar,2
  Panama,GoPhish,2
  Mexico,Quasar,2
  Peru,Havoc,2
  Brazil,AsyncRAT,2
  Peru,CHAOS,2
  Brazil,CHAOS,2
  Chile,CHAOS,2
  Brazil,Mythic,1
  Panama,Sliver,1

ASN → Threat (top)

---
config:
  theme: dark
---
%% ASN → Threat (top)
sankey-beta
  31898,GoPhish,16
  3816,GoPhish,16
  3816,AsyncRAT,11
  396982,GoPhish,7
  16509,GoPhish,7
  52368,GoPhish,7
  27831,DCRat,6
  27823,GoPhish,5
  7418,GoPhish,5
  271239,GoPhish,4
  8075,GoPhish,4
  7418,Hack5 Cloud C2,4
  12252,GoPhish,3
  15830,GoPhish,3
  16735,GoPhish,3
  11014,GoPhish,3
  3132,GoPhish,3
  16509,Quasar,3
  18747,GoPhish,3
  47583,GoPhish,3
  138915,CHAOS,3
  270564,Quasar,2
  23201,GoPhish,2
  53107,GoPhish,2
  28343,GoPhish,2
  8151,GoPhish,2
  138915,Sliver,2
  52469,GoPhish,2
  47583,Quasar,2
  11172,Quasar,2

Delta vs previous snapshot

• IPs: +13 / -0 (persistent: 219)
• Threat frameworks: +0 / -0
• Countries: +0 / -0
• ASNs: +2 / -1
• ISPs: +10 / -5
• Orgs: +11 / -0
• Ports: +5 / -0
• Cities: +5 / -3

Delta lists (compact)

• New IPs: 128.90.123.232, 144.22.254.140, 179.9.52.0, 18.228.142.33, 181.49.195.50, 186.169.88.130, 189.249.193.61, 189.249.195.86, 190.255.83.163, 200.155.77.90, 200.17.160.201, 45.225.128.175, 64.176.14.101
• Removed IPs: none
• New threats: none
• Removed threats: none
• New countries: none
• New ASNs: 14080, 2716
• New ISPs: Altatech Soluções em Tecnologia EIRELI, Colombia Móvil, Equinix (EMEA) Acquisition Enterprises B.V., INFOLINK TELECOM, Level 3 Parent, LLC, Telmex Colombia S.A., The Constant Company, LLC, UNIFIQUE TELECOMUNICACOES S/A, Universidade Federal do Rio Grande do Sul, Vialink Soluções de Tecnologia Ltda
• New ports: 25001, 50001, 5012, 6001, 9070

IP reuse / threat drift

• No IP reuse / drift detected (between these two snapshots).

Delta graph: NEW Country → Threat edges

---
config:
  theme: dark
---
%% Δ Country → Threat (new edges)
sankey-beta
  Chile,CHAOS,2

Delta graph: NEW ASN → Threat edges

---
config:
  theme: dark
---
%% Δ ASN → Threat (new edges)
sankey-beta
  Not Found,Sliver,2
  20473,CHAOS,2
  27831,AsyncRAT,1
  14080,GoPhish,1
  2716,GoPhish,1

All IPs (current snapshot)

Current snapshot link: https://gitlab.com/zoquelabs/olim_datasets/-/tree/main/reports/2026-08-07_11-06-30?ref_type=heads