On 20180124, some unwanted files got uploaded to Phabricator shared between 15 users in https://phabricator.wikimedia.org/Z644 .
(For Phab admins: https://phabricator.wikimedia.org/people/query/all/ shows when most accounts registered etc)
Looking at the IPs of those uploaders who did not use proxies in European countries, all IPs used by uploaders were in IP ranges of CASA_4G_MarocTelecom (according to whois).
Also see T168142 for historical context.
It is also possible for Moroccan "Inwi Mobile" users to access Phabricator. (INWI-Internet-UGW-CAS01, This subnet is dedicated to 2G/3G/4G customers) who did not upload content though.
CC'ing @Mholloway as they recently helped on T173537 (feel free to remove yourself!)