Attack traffic from Morocco
Honeypot telemetry for sources geolocated to Morocco
Observed by OffSeq honeypot sensors · last 30 days · last seen 4 minutes ago · first observed 2026-08-03 (30 days ago)
14,937
Attacks
116
Distinct source IPs
11
KEV exploit hits
Attack traffic is led by MT-MPLS, most often targeting CVE-2017-9841.
OffSeq honeypot sensors recorded 14,937 attacks from 116 distinct hosts geolocated to Moroccoin the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
CVEs targeted
Techniques
- T1595 Active Scanning9,758
- T1110 Brute Force2,222
- T1592 Gather Victim Host Information800
- T1190 Exploit Public-Facing Application672
- T1552 Unsecured Credentials408
- T1059 Command and Scripting Interpreter74
- T1595.002 Vulnerability Scanning30
- T1046 Network Service Discovery15
- T1210 Exploitation of Remote Services12
- T1552.001 Credentials In Files4
- T1059.004 Unix Shell4
- T1105 Ingress Tool Transfer2
Top networks (ASNs)
- MT-MPLS11,588
- IAM-AS1,995
- M24760
- ASMedi31
- MAROCCONNECT6