ZOLIM - Zoque-Observatorio Latinoamericano de Infraestructura Maliciosa

ZOLIM (Observatorio Latinoamericano de Infraestructura Maliciosa de Zoque) es una iniciativa de investigación de ZoqueLabs orientada a documentar, analizar y publicar snapshots periódicos de infraestructura maliciosa en América Latina, con énfasis en sistemas de comando y control (C2) y tooling asociado.

• Generated: 2026-03-18T16:50:06Z
• About ZOLIM: Español - English
• Current snapshot: https://github.com/ZoqueLabs/olim_datasets/tree/main/reports/2026-03-18_11-50-06

Metrics (current)

IPs: 116

Unique ports: 32

Threat frameworks: 13

Countries: 14

Cities: 42

ASNs: 54

Tops (current)

• Threats: GoPhish(66) Quasar(18) Sliver(12) DCRat(8) Cobalt Strike(4) Havoc(4) CHAOS(4) Hack5 Cloud C2(2) AsyncRAT(1) Mythic(1) njRat(1) Metasploit(1)
• Countries: Brazil(60) Colombia(13) Mexico(9) Peru(7) Chile(7) Argentina(6) Panama(3) Paraguay(3) Honduras(2) Venezuela, Bolivarian Republic of(2) El Salvador(1) Costa Rica(1)
• Cities: São Paulo(45) Lima(7) Barranquilla(6) Santiago(5) Buenos Aires(4) Panamá(3) Belo Horizonte(2) Radica(2) Asunción(2) Rolândia(2) Mexico City(2) Santiago de Querétaro(2)
• ASNs: 31898(13) 16509(9) 27831(6) 8075(5) 63949(4) 3816(4) 47583(4) 138915(4) 53107(3) 52469(3) 11014(3) 271239(3)
• ISPs: ORACLE-BMC-31898 - Oracle Corporation(11) AMAZON-02 - Amazon.com, Inc.(7) Colombia Movil(5) Microsoft Corporation(4) COLOMBIA TELECOMUNICACIONES S.A. ESP BIC(4) AS-HOSTINGER(4) EVEO S.A.(3) Offshore Racks S.A(3) CPS(3) TELEFONICA BRASIL S.A(3) Altatech Solucoes em Tecnologia EIRELI(3) Kaopu Cloud HK Limited(3)
• Orgs: unknown(81) Microsoft Corporation(4) Offshore Racks S.A(2) Oracle Corporation(2) Amazon Data Services Brazil(2) Linode(2) ZAM LTDA.(2) Kaopu Cloud HK Limited(2) Colombia Móvil(1) Equinix Services, Inc.(1) GLOBAL CONNECTIVITY SOLUTIONS LLP(1) Univ. Catolica Nuestra Senora de la Asuncion(1)
• Ports (frequency across IPs): 3333(34) 443(22) 31337(11) 8080(10) 80(8) 8848(4) 9000(3) 43333(3) 1080(2) 8443(2) 8081(2) 9090(2)

Graphs (current)

---
config:
  theme: dark
---
pie title Threats
  "GoPhish" : 66
  "Quasar" : 18
  "Sliver" : 12
  "DCRat" : 8
  "Cobalt Strike" : 4
  "Havoc" : 4
  "CHAOS" : 4
  "Hack5 Cloud C2" : 2
  "AsyncRAT" : 1
  "Mythic" : 1
  "njRat" : 1
  "Metasploit" : 1

---
config:
  theme: dark
---
pie title Countries
  "Brazil" : 60
  "Colombia" : 13
  "Mexico" : 9
  "Peru" : 7
  "Chile" : 7
  "Argentina" : 6
  "Panama" : 3
  "Paraguay" : 3
  "Honduras" : 2
  "Venezuela, Bolivarian Republic of" : 2
  "El Salvador" : 1
  "Costa Rica" : 1

---
config:
  theme: dark
---
pie title ASNs
  "31898" : 13
  "16509" : 9
  "27831" : 6
  "8075" : 5
  "63949" : 4
  "3816" : 4
  "47583" : 4
  "138915" : 4
  "53107" : 3
  "52469" : 3
  "11014" : 3
  "271239" : 3

---
config:
  theme: dark
---
pie title ISPs
  "ORACLE-BMC-31898 - Oracle Corporation" : 11
  "AMAZON-02 - Amazon.com, Inc." : 7
  "Colombia Movil" : 5
  "Microsoft Corporation" : 4
  "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC" : 4
  "AS-HOSTINGER" : 4
  "EVEO S.A." : 3
  "Offshore Racks S.A" : 3
  "CPS" : 3
  "TELEFONICA BRASIL S.A" : 3
  "Altatech Solucoes em Tecnologia EIRELI" : 3
  "Kaopu Cloud HK Limited" : 3

Country → Threat (top)

---
config:
  theme: dark
---
%% Country → Threat (top)
sankey-beta
  Brazil,GoPhish,27
  Brazil,Quasar,10
  Brazil,Sliver,8
  Colombia,DCRat,7
  Mexico,GoPhish,7
  Chile,GoPhish,7
  Peru,GoPhish,6
  Argentina,GoPhish,6
  Colombia,GoPhish,5
  Brazil,Havoc,4
  Brazil,Cobalt Strike,3
  Paraguay,GoPhish,3
  Chile,Quasar,2
  Panama,GoPhish,2
  Mexico,Quasar,2
  Peru,CHAOS,2
  Brazil,CHAOS,2
  Colombia,AsyncRAT,1
  Brazil,Mythic,1
  Brazil,Hack5 Cloud C2,1
  Mexico,Sliver,1
  Panama,Sliver,1
  Peru,Quasar,1
  El Salvador,GoPhish,1
  Costa Rica,GoPhish,1
  Ecuador,GoPhish,1
  Brazil,DCRat,1
  Honduras,Quasar,1
  Colombia,Quasar,1
  Venezuela  Bolivarian Republic of,Cobalt Strike,1

ASN → Threat (top)

---
config:
  theme: dark
---
%% ASN → Threat (top)
sankey-beta
  31898,GoPhish,9
  27831,DCRat,5
  396982,GoPhish,4
  52368,GoPhish,4
  12252,GoPhish,3
  11014,GoPhish,3
  271239,GoPhish,3
  16509,GoPhish,3
  16509,Quasar,3
  138915,CHAOS,3
  270564,Quasar,2
  15830,GoPhish,2
  23201,GoPhish,2
  53107,GoPhish,2
  3132,GoPhish,2
  8075,GoPhish,2
  27823,GoPhish,2
  3816,GoPhish,2
  138915,Sliver,2
  52469,GoPhish,2
  47583,Quasar,2
  11172,Quasar,2
  31898,Quasar,2
  3816,DCRat,2
  18747,GoPhish,2
  267121,Sliver,2
  8075,Sliver,2
  53107,Cobalt Strike,1
  27831,AsyncRAT,1
  52601,Sliver,1

Delta vs previous snapshot

• IPs: +12 / -0 (persistent: 104)
• Threat frameworks: +0 / -1
• Countries: +0 / -0
• ASNs: +3 / -0
• ISPs: +5 / -1
• Orgs: +2 / -1
• Ports: +2 / -3
• Cities: +4 / -0

Delta lists (compact)

• New IPs: 150.230.93.32, 181.79.36.228, 186.169.63.171, 187.84.150.111, 187.84.150.127, 190.66.83.233, 191.93.113.86, 40.233.19.225, 45.238.142.234, 46.202.146.65, 52.67.113.111, 56.125.42.70
• Removed IPs: none
• New threats: none
• Removed threats: UnamWebPanel
• New countries: none
• New ASNs: 18747, 263686, 267121
• New ISPs: ATPlus Telecom, BIZZ INTERNET LTDA, Colombia Móvil, IFX18747 - IFX Corporation, INET Communication
• New ports: 12136, 3057

IP reuse / threat drift

• IPs with threat changes: 2
  • 177.124.72.24: [‘Sliver’, ‘UnamWebPanel’] → [‘Sliver’] (+[], -[‘UnamWebPanel’])
  • 191.93.118.254: [‘AsyncRAT’, ‘DCRat’] → [‘AsyncRAT’] (+[], -[‘DCRat’])

Delta graph: NEW Country → Threat edges

---
config:
  theme: dark
---
%% Δ Country → Threat (new edges)
sankey-beta
  Honduras,Hack5 Cloud C2,1

Delta graph: NEW ASN → Threat edges

---
config:
  theme: dark
---
%% Δ ASN → Threat (new edges)
sankey-beta
  18747,GoPhish,2
  267121,Sliver,2
  47583,GoPhish,1
  263686,Hack5 Cloud C2,1
  16509,Havoc,1

All IPs (current snapshot)

Current snapshot link: https://github.com/ZoqueLabs/olim_datasets/tree/main/reports/2026-03-18_11-50-06