Attack traffic from Morocco

Honeypot telemetry for sources geolocated to Morocco

Observed by OffSeq honeypot sensors · last 7 days · last seen 6 hours ago · first observed 2026-10-16 (6 days ago)

729

Attacks

Distinct source IPs

Attack traffic is led by ASMedi.

OffSeq honeypot sensors recorded 729 attacks from 13 distinct hosts geolocated to Moroccoin the last 7 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.

Techniques

T1110 Brute Force716
T1552.001 Credentials In Files2
T1552 Unsecured Credentials2
T1190 Exploit Public-Facing Application2
T1595 Active Scanning2
T1210 Exploitation of Remote Services1

Services attacked

Microsoft SQL Server711
HTTP8
RDP7
SSH2
SMB1

Top networks (ASNs)

ASMedi710
IAM-AS11
MarocTelecomASDL7
MAROCCONNECT1

Sample request paths

/meridian-systems/ledger-api.git /.env /cenradis/.env /pakalpojumi/.env

Open the live view →