AWS Credentials File Grab for 2026-09-26

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

IP Address : ASN : City/Provider

• 134.185.93.91 : ASNone : United States of America

• 144.172.93.238 : AS46261 quickpacket llc : United States of America

• 161.118.246.79 : ASNone : Japan

• 178.18.240.38 : AS51167 contabo gmbh : Germany

• 185.218.86.5 : AS1239 sprint : Bulgaria

• 207.175.220.59 : ASNone : United States of America

• 34.153.215.84 : AS396982 google : United States of America

• 34.156.135.225 : AS15169 google llc : United States of America

• 34.156.22.151 : AS15169 google llc : United States of America

• 34.159.199.49 : unknown : unknown

• 34.159.202.132 : unknown : unknown

• 34.159.229.182 : AS396982 google : United States of America

• 34.16.104.26 : ASNone : United States of America

• 34.170.215.77 : AS396982 google : United States of America

• 34.177.84.228 : unknown : unknown

• 34.178.234.70 : unknown : unknown

• 34.178.239.21 : AS15169 google llc : United States of America

• 34.186.207.93 : AS15169 google llc : United States of America

• 34.52.229.253 : ASNone : United States of America

• 34.62.82.165 : ASNone : United States of America

• 34.77.137.207 : AS396982 google : Brussels

• 35.190.139.144 : unknown : unknown

• 45.138.12.24 : AS3561 centurylink communications llc : Lithuania

• 45.138.12.25 : AS3561 centurylink communications llc : Lithuania

• 45.138.12.52 : AS3561 centurylink communications llc : Lithuania

• 8.229.153.87 : unknown : unknown

• 80.94.95.211 : AS35478 bunea telecom srl : Romania