AWS Credentials File Grab for 2026-06-29
Last Updated: 12:00 UTC
Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API
Observed URIs
Attackers by Country
| United Kingdom of Great Britain and Northern Ireland | 3 | 33.3% |
| United States of America | 2 | 22.2% |
| India | 1 | 11.1% |
| Peru | 1 | 11.1% |
| Germany | 1 | 11.1% |
| Russian Federation | 1 | 11.1% |
IP Address : ASN : City/Provider
-
103.168.66.237 : AS142430 digi vps : India
-
103.215.74.213 : ASNone : unknown
-
158.94.210.233 : AS786 jisc services limited : United Kingdom of Great Britain and Northern Ireland
-
172.71.174.224 : ASNone : United States of America
-
185.177.72.30 : ASNone : Congleton
-
195.178.110.102 : AS30823 combahton gmbh : Reston
-
198.41.227.133 : AS13335 cloudflare : Lima
-
213.209.159.175 : AS42821 k&k kommunikationssysteme gmbh : Germany
-
46.37.124.55 : AS52037 blackbridge limited : United Kingdom of Great Britain and Northern Ireland
-
95.182.114.5 : AS48780 oltelecom jsc : Olenegorsk