AWS Credentials File Grab for 2026-10-06

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

IP Address : ASN : City/Provider

• 104.155.231.82 : AS396982 google : New Taipei

• 136.108.205.69 : ASNone : United States of America

• 136.110.90.22 : ASNone : United States of America

• 136.118.232.245 : AS15169 google llc : United States of America

• 34.107.50.145 : AS396982 google : Frankfurt am Main

• 34.139.213.174 : AS15169 google llc : North Charleston

• 34.142.246.133 : AS396982 google : United States of America

• 34.148.214.190 : AS15169 google llc : North Charleston

• 34.159.2.229 : AS396982 google : United States of America

• 34.169.4.54 : AS396982 google : United States of America

• 34.39.128.47 : ASNone : United States of America

• 34.53.206.200 : ASNone : United States of America

• 34.62.17.104 : ASNone : United States of America

• 34.62.90.227 : ASNone : United States of America

• 34.73.94.184 : AS396982 google : North Charleston

• 34.76.234.133 : AS396982 google : Brussels

• 34.76.247.10 : AS396982 google : Brussels

• 34.81.43.128 : AS396982 google : New Taipei

• 34.91.238.189 : AS396982 google : Groningen

• 35.202.236.104 : AS396982 google : Council Bluffs

• 35.225.142.233 : AS396982 google : Council Bluffs

• 35.226.49.48 : AS15169 google llc : Council Bluffs

• 35.236.200.191 : AS396982 google : Washington

• 35.245.106.123 : AS396982 google : Washington

• 45.148.10.120 : unknown : unknown

• 45.153.34.43 : AS44592 skylink data center bv : Germany

• 45.156.87.16 : AS213030 skylink data center bv : Germany

• 80.94.95.211 : AS35478 bunea telecom srl : Romania