AWS Credentials File Grab for 2026-09-18

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

IP Address : ASN : City/Provider

• 20.106.228.98 : unknown : unknown

• 213.209.159.175 : AS42821 k&k kommunikationssysteme gmbh : Germany

• 3.82.141.143 : AS14618 amazon.com inc. : Ashburn

• 34.14.83.108 : ASNone : United States of America

• 34.140.208.125 : AS15169 google llc : Brussels

• 34.143.138.210 : AS396982 google : United States of America

• 34.143.238.151 : AS396982 google : United States of America

• 34.16.46.254 : ASNone : United States of America

• 34.168.114.44 : AS396982 google : United States of America

• 34.169.236.252 : AS396982 google : United States of America

• 34.169.89.137 : AS396982 google : United States of America

• 34.172.104.89 : AS396982 google : United States of America

• 34.173.29.122 : AS396982 google : United States of America

• 34.173.92.71 : AS396982 google : United States of America

• 34.21.186.146 : ASNone : United States of America

• 34.21.200.201 : ASNone : United States of America

• 34.22.201.194 : ASNone : United States of America

• 34.22.253.224 : ASNone : United States of America

• 34.52.133.111 : ASNone : United States of America

• 34.62.116.145 : ASNone : United States of America

• 34.77.137.207 : AS396982 google : Brussels

• 35.240.58.49 : AS15169 google llc : Brussels

• 35.241.202.92 : AS15169 google llc : Brussels

• 45.138.12.26 : AS3561 centurylink communications llc : Lithuania

• 45.138.12.28 : AS3561 centurylink communications llc : Lithuania

• 45.138.12.30 : AS3561 centurylink communications llc : Lithuania

• 45.45.237.69 : ASNone : unknown

• 80.94.95.211 : AS35478 bunea telecom srl : Romania