AWS Credentials File Grab for 2026-10-16

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

IP Address : ASN : City/Provider

• 136.70.62.1 : AS396982 Google LLC : The Dalles

• 136.70.72.114 : AS396982 Google LLC : Washington

• 136.85.82.40 : AS396982 Google LLC : Singapore

• 209.99.189.217 : AS402253 SKN Subnet & Telecom Ltd : Zurich

• 34.126.145.141 : AS396982 Google LLC : Singapore

• 34.13.132.70 : AS396982 Google LLC : Groningen

• 34.151.205.161 : AS396982 Google LLC : São Paulo

• 34.156.249.47 : AS396982 Google LLC : Brussels

• 34.178.225.147 : AS396982 Google LLC : Groningen

• 34.181.218.133 : AS396982 Google LLC : Washington

• 34.23.56.252 : AS396982 Google LLC : North Charleston

• 34.32.216.134 : AS396982 Google LLC : Groningen

• 34.38.113.44 : AS396982 Google LLC : Brussels

• 34.6.175.102 : AS396982 Google LLC : Groningen

• 34.79.51.100 : AS396982 Google LLC : Brussels

• 34.86.26.236 : AS396982 Google LLC : Washington

• 34.95.48.207 : AS396982 Google LLC : Montreal

• 35.198.37.200 : AS396982 Google LLC : São Paulo

• 35.203.26.153 : AS396982 Google LLC : Montreal

• 35.221.16.171 : AS396982 Google LLC : Washington

• 35.240.156.31 : AS396982 Google LLC : Singapore

• 35.247.245.80 : AS396982 Google LLC : São Paulo

• 45.134.225.48 : AS213438 ColocaTel Inc. : Amsterdam

• 45.148.10.64 : AS48090 Techoff Srv Limited : Amsterdam

• 45.153.34.249 : AS197170 TechTies Inc. : Amsterdam

• 80.94.95.211 : AS204428 SS-Net : Romania

• 85.11.167.138 : AS197170 TechTies Inc. : Amsterdam

• 93.152.221.34 : AS197170 TechTies Inc. : Frankfurt am Main