AWS Credentials File Grab for 2026-10-06

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

IP Address : ASN : City/Provider

• 104.155.231.82 : AS396982 Google LLC : Taipei

• 136.108.205.69 : AS396982 Google LLC : North Charleston

• 136.110.90.22 : AS396982 Google LLC : Tokyo

• 136.118.232.245 : AS396982 Google LLC : The Dalles

• 34.107.50.145 : AS396982 Google LLC : Frankfurt am Main

• 34.139.213.174 : AS396982 Google LLC : North Charleston

• 34.142.246.133 : AS396982 Google LLC : Singapore

• 34.148.214.190 : AS396982 Google LLC : North Charleston

• 34.159.2.229 : AS396982 Google LLC : Frankfurt am Main

• 34.169.4.54 : AS396982 Google LLC : The Dalles

• 34.39.128.47 : AS396982 Google LLC : São Paulo

• 34.53.206.200 : AS396982 Google LLC : Brussels

• 34.62.17.104 : AS396982 Google LLC : Brussels

• 34.62.90.227 : AS396982 Google LLC : Brussels

• 34.73.94.184 : AS396982 Google LLC : North Charleston

• 34.76.234.133 : AS396982 Google LLC : Brussels

• 34.76.247.10 : AS396982 Google LLC : Brussels

• 34.81.43.128 : AS396982 Google LLC : Taipei

• 34.91.238.189 : AS396982 Google LLC : Groningen

• 35.202.236.104 : AS396982 Google LLC : Council Bluffs

• 35.225.142.233 : AS396982 Google LLC : Council Bluffs

• 35.226.49.48 : AS396982 Google LLC : Council Bluffs

• 35.236.200.191 : AS396982 Google LLC : Washington

• 35.245.106.123 : AS396982 Google LLC : Washington

• 45.148.10.120 : AS48090 Techoff Srv Limited : Amsterdam

• 45.153.34.43 : AS197170 TechTies Inc. : Amsterdam

• 45.156.87.16 : AS197170 TechTies Inc. : Amsterdam

• 80.94.95.211 : AS204428 SS-Net : Romania