🇲🇦 Morocco: live cyber threat activity

Malicious IPs, malware and ransomware victims in Morocco.

95Malicious IPs listed#47 of 182 countries · 0.14% of the world
20New in the last 24hfirst seen by any feed
20Reported by 2+ feedsindependent sources agree
3Ransomware victimsposted in the last 30 days

View Morocco on the live map →All listed IPs in MoroccoRansomware victims in Morocco

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C28
  2. Malware40
  3. Phishing0
  4. Attacker47

By state or region

  1. Rabat-Salé-Kénitra34
  2. Tanger-Tetouan-Al Hoceima23
  3. Casablanca-Settat19
  4. Marrakesh-Safi8
  5. Fes-Meknes5
  6. Souss-Massa4
  7. Drâa-Tafilalet1
  8. Laayoune-Sakia El Hamra1

By city

  1. Rabat30
  2. Tangier13
  3. Boukhalef5
  4. Casablanca4
  5. Lahraouyine4
  6. Marrakesh4
  7. Tit Mellil4
  8. Safi3
  9. Fes3
  10. Salé2
  11. Tétouan2
  12. Bouskoura2
  13. Aïn Attig1
  14. Berrechid1
  15. Kenitra1

Networks hosting the most

NetworkIPs
AS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM 39
AS6713 Itissalat Al-MAGHRIB 29
AS36941 MTDS 14
AS36925 MEDITELECOM 7
AS36884 Wana Corporate 6

Malware families served from Morocco

  1. AsyncRAT8
  2. Stealerc1
  3. Gandcrab1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
41.216.227[.]122MalwareMalware downloadRabat, Rabat-Salé-KénitraAS36941 MTDSaggregated list2026-10-12 07:32
105.188.125[.]205AttackerAttacking hostCasablanca, Casablanca-SettatAS36925 MEDITELECOM1 feed2026-10-12 05:00
102.97.198[.]27AttackerAttacking hostTangier, Tanger-Tetouan-Al HoceimaAS36925 MEDITELECOM2 feeds2026-10-12 04:35
105.158.194[.]63AttackerAttacking hostTangier, Tanger-Tetouan-Al HoceimaAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM2 feeds2026-10-12 04:35
160.176.248[.]175MalwareMalicious IPMdiq, Tanger-Tetouan-Al HoceimaAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 feed2026-10-12 04:35
160.176.254[.]189MalwareMalicious IPMartil, Tanger-Tetouan-Al HoceimaAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 feed2026-10-12 04:35
196.114.173[.]115AttackerAttacking hostMarrakesh, Marrakesh-SafiAS36925 MEDITELECOM2 feeds2026-10-12 04:35
196.117.83[.]49AttackerAttacking hostCasablanca, Casablanca-SettatAS36925 MEDITELECOM2 feeds2026-10-12 04:35
196.127.89[.]84AttackerMalicious IPLahraouyine, Casablanca-SettatAS36925 MEDITELECOM1 feed2026-10-12 04:35
196.70.175[.]245AttackerMalicious IPMeknes, Fes-MeknesAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 feed2026-10-12 04:35
196.74.47[.]206MalwareMalicious IPOulad Teïma, Souss-MassaAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 feed2026-10-12 04:35
41.140.196[.]237AttackerAttacking hostSalé, Rabat-Salé-KénitraAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM2 feeds2026-10-12 04:35
41.248.244[.]236AttackerAttacking hostRabat, Rabat-Salé-KénitraAS6713 Itissalat Al-MAGHRIB2 feeds2026-10-12 04:35
41.251.151[.]107AttackerMalicious IPMohammedia, Casablanca-SettatAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 feed2026-10-12 04:35
102.53.8[.]112MalwareMalicious URLRabat, Rabat-Salé-KénitraAS6713 Itissalat Al-MAGHRIBaggregated list2026-10-12 04:35
41.216.227[.]33MalwareMalicious URLRabat, Rabat-Salé-KénitraAS36941 MTDSaggregated list2026-10-12 04:35
160.177.150[.]131AttackerAttacking hostTounfit, Drâa-TafilaletAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 feed2026-10-12 04:05
105.158.174[.]191AttackerAttacking hostKenitra, Rabat-Salé-KénitraAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 feed2026-10-12 00:15
105.157.233[.]28AttackerAttacking hostLahraouyine, Casablanca-SettatAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 feed2026-10-11 18:41
105.77.210[.]247AttackerAttacking hostTétouan, Tanger-Tetouan-Al HoceimaAS36884 Wana Corporate1 feed2026-10-11 16:00
196.206.139[.]244MalwareMalware downloadRabat, Rabat-Salé-KénitraAS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAMaggregated list2026-10-11 04:31
154.146.235[.]32AttackerMalicious IPRabat, Rabat-Salé-KénitraAS6713 Itissalat Al-MAGHRIB2 feeds2026-10-11 04:31
154.144.255[.]208AttackerAttacking hostTangier, Tanger-Tetouan-Al HoceimaAS6713 Itissalat Al-MAGHRIB2 feeds2026-10-11 04:30
154.146.242[.]43AttackerAttacking hostSafi, Marrakesh-SafiAS6713 Itissalat Al-MAGHRIB1 feed2026-10-11 03:30
105.68.200[.]232AttackerAttacking hostSalé, Rabat-Salé-KénitraAS36884 Wana Corporate1 feed2026-10-10 22:25

See every listed IP in Morocco →

Ransomware victims in Morocco

3 posted in the last 30 days, 5 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-11 12:03CNESTENqilinGovernment & Defense
2026-09-25 10:33pharma5.maincransomHealthcare
2026-09-12 10:30lasultanahotels.comkrybitHospitality
2026-08-14 05:55Avanta Maroc Ex AdeccothegentlemenProfessional Services
2026-07-26 10:02Brazer IngenieriearcusmediaManufacturing

All ransomware victims in Morocco →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378All countries →