AWS Credentials File Grab for 2026-09-22
Last Updated: 00:00 UTC
Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API
Observed URIs
Attackers by Country
| United States | 12 | 33.3% |
| Singapore | 12 | 33.3% |
| Belgium | 4 | 11.1% |
| Taiwan | 2 | 5.6% |
| Lithuania | 2 | 5.6% |
| United Arab Emirates | 1 | 2.8% |
| Moldova | 1 | 2.8% |
| The Netherlands | 1 | 2.8% |
| Romania | 1 | 2.8% |
IP Address : ASN : City/Provider
-
136.109.44.10 : AS396982 Google LLC : The Dalles
-
136.117.84.25 : AS396982 Google LLC : The Dalles
-
144.172.93.238 : AS14956 RouterHosting LLC : Ogden
-
31.59.160.3 : AS203861 Miteflux Technologies Ltd : United Arab Emirates
-
34.140.234.80 : AS396982 Google LLC : Brussels
-
34.143.239.179 : AS396982 Google LLC : Singapore
-
34.156.57.140 : AS396982 Google LLC : Brussels
-
34.158.63.66 : AS396982 Google LLC : Singapore
-
34.168.208.175 : AS396982 Google LLC : The Dalles
-
34.177.92.194 : AS396982 Google LLC : Singapore
-
34.182.28.249 : AS396982 Google LLC : The Dalles
-
34.182.98.201 : AS396982 Google LLC : The Dalles
-
34.187.212.98 : AS396982 Google LLC : The Dalles
-
34.187.247.197 : AS396982 Google LLC : The Dalles
-
34.19.24.62 : AS396982 Google LLC : The Dalles
-
34.19.57.29 : AS396982 Google LLC : The Dalles
-
34.19.91.56 : AS396982 Google LLC : The Dalles
-
34.21.139.106 : AS396982 Google LLC : Singapore
-
34.21.168.36 : AS396982 Google LLC : Singapore
-
34.21.168.53 : AS396982 Google LLC : Singapore
-
34.21.168.79 : AS396982 Google LLC : Singapore
-
34.21.173.167 : AS396982 Google LLC : Singapore
-
34.21.183.186 : AS396982 Google LLC : Singapore
-
34.21.206.55 : AS396982 Google LLC : Singapore
-
34.21.208.252 : AS396982 Google LLC : Singapore
-
34.44.236.95 : AS396982 Google LLC : Council Bluffs
-
34.52.146.37 : AS396982 Google LLC : Brussels
-
35.197.155.101 : AS396982 Google LLC : Singapore
-
35.221.223.137 : AS396982 Google LLC : Taipei
-
35.221.226.105 : AS396982 Google LLC : Taipei
-
35.241.239.86 : AS396982 Google LLC : Brussels
-
45.115.27.35 : AS209883 Contrust Solutions S.R.L. : Moldova
-
45.138.12.51 : unknown : Lithuania
-
45.138.12.52 : unknown : Lithuania
-
45.148.10.120 : AS48090 Techoff Srv Limited : Amsterdam
-
80.94.95.211 : AS204428 SS-Net : Romania