AWS Credentials File Grab for 2026-10-21
Last Updated: 00:00 UTC
Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API
Observed URIs
Attackers by Country
| United States | 46 | 27.9% |
| France | 30 | 18.2% |
| The Netherlands | 28 | 17.0% |
| Bulgaria | 8 | 4.8% |
| Germany | 8 | 4.8% |
| Singapore | 7 | 4.2% |
| United Kingdom | 6 | 3.6% |
| Spain | 4 | 2.4% |
| India | 3 | 1.8% |
| Russia | 3 | 1.8% |
| Japan | 3 | 1.8% |
| Lithuania | 2 | 1.2% |
| Canada | 2 | 1.2% |
| Romania | 2 | 1.2% |
| Philippines | 1 | 0.6% |
| Indonesia | 1 | 0.6% |
| Sweden | 1 | 0.6% |
| Belize | 1 | 0.6% |
| Switzerland | 1 | 0.6% |
| Türkiye | 1 | 0.6% |
| Hong Kong | 1 | 0.6% |
| Taiwan | 1 | 0.6% |
| Belgium | 1 | 0.6% |
| South Africa | 1 | 0.6% |
| Seychelles | 1 | 0.6% |
| Ukraine | 1 | 0.6% |
| Czechia | 1 | 0.6% |
IP Address : ASN : City/Provider
-
103.150.221.142 : AS140599 COMFAC CORPORATION : Pampanga
-
103.153.183.69 : AS140947 SnTHostings : Dallas
-
103.168.66.237 : AS142430 DIGI VPS : Dallas
-
104.28.211.192 : AS13335 Cloudflare, Inc. : Paris
-
109.202.99.36 : AS49453 Global Layer B.V. : The Netherlands
-
109.202.99.46 : AS49453 Global Layer B.V. : The Netherlands
-
124.158.184.77 : AS55685 PT Jala Lintas Media : Jakarta
-
13.60.182.129 : AS16509 Amazon.com, Inc. : Stockholm
-
13.72.78.196 : AS8075 Microsoft Corporation : Dulles
-
135.125.182.43 : AS16276 OVH SAS : France
-
136.66.105.27 : AS396982 Google LLC : The Dalles
-
138.226.236.53 : AS205775 Neon Core Network LLC : Belize City
-
139.59.239.54 : AS14061 DigitalOcean, LLC : Singapore
-
139.59.76.9 : AS14061 DigitalOcean, LLC : Bengaluru
-
140.238.250.166 : AS31898 Oracle Corporation : Mumbai
-
140.99.254.97 : AS63023 GTHost : Ashburn
-
141.11.62.235 : AS214481 Wojciech Czapkowicz : Amsterdam
-
141.98.11.152 : AS209605 UAB Host Baltic : Vilnius
-
150.241.113.97 : AS210546 Chsl One Ltd : United States
-
152.42.249.165 : AS14061 DigitalOcean, LLC : Singapore
-
154.58.229.20 : AS400810 BreezeHost : New York
-
157.230.249.43 : AS14061 DigitalOcean, LLC : Singapore
-
158.94.210.233 : AS202412 Omegatech LTD : Amsterdam
-
162.141.167.49 : AS19318 Interserver, Inc : United States
-
162.141.167.71 : AS19318 Interserver, Inc : United States
-
167.114.165.168 : AS16276 OVH SAS : Montreal
-
176.99.9.88 : AS49352 Domain names registrar REG.RU, Ltd : Russia
-
179.43.149.114 : AS51852 Private Layer INC : Rümlang
-
18.212.122.225 : AS14618 Amazon.com, Inc. : Ashburn
-
184.154.159.210 : AS32475 Internap Holding LLC : United States
-
185.177.72.10 : AS211590 Bucklog SARL : France
-
185.177.72.104 : AS211590 Bucklog SARL : France
-
185.177.72.106 : AS211590 Bucklog SARL : France
-
185.177.72.108 : AS211590 Bucklog SARL : France
-
185.177.72.111 : AS211590 Bucklog SARL : France
-
185.177.72.113 : AS211590 Bucklog SARL : France
-
185.177.72.115 : AS211590 Bucklog SARL : France
-
185.177.72.12 : AS211590 Bucklog SARL : France
-
185.177.72.144 : AS211590 Bucklog SARL : France
-
185.177.72.16 : AS211590 Bucklog SARL : France
-
185.177.72.179 : AS211590 Bucklog SARL : France
-
185.177.72.201 : AS211590 Bucklog SARL : France
-
185.177.72.204 : AS211590 Bucklog SARL : France
-
185.177.72.205 : AS211590 Bucklog SARL : France
-
185.177.72.210 : AS211590 Bucklog SARL : France
-
185.177.72.23 : AS211590 Bucklog SARL : France
-
185.177.72.236 : AS211590 Bucklog SARL : France
-
185.177.72.24 : AS211590 Bucklog SARL : France
-
185.177.72.30 : AS211590 Bucklog SARL : France
-
185.177.72.38 : AS211590 Bucklog SARL : France
-
185.177.72.50 : AS211590 Bucklog SARL : France
-
185.177.72.55 : AS211590 Bucklog SARL : France
-
185.177.72.7 : AS211590 Bucklog SARL : France
-
185.177.72.9 : AS211590 Bucklog SARL : France
-
185.196.9.254 : unknown : unknown
-
185.213.174.71 : AS41608 NextGenWebs, S.L. : Dronten
-
185.54.229.51 : AS137409 GSL Networks Pty LTD : Japan
-
185.63.189.198 : AS29182 JSC IOT : Russia
-
185.83.144.103 : AS51559 Netinternet Bilisim Teknolojileri AS : Türkiye
-
187.127.227.211 : AS47583 Hostinger International Limited : Paris
-
188.165.125.250 : AS16276 OVH SAS : France
-
188.166.229.190 : AS14061 DigitalOcean, LLC : Singapore
-
192.169.176.214 : AS398101 GoDaddy.com, LLC : United States
-
192.210.193.217 : AS36352 HostPapa : Los Angeles
-
193.32.126.162 : AS39351 31173 Services AB : Paris
-
194.163.184.179 : AS51167 Contabo GmbH : Lauterbourg
-
194.26.192.60 : AS210558 1337 Services GmbH : Lelystad
-
194.42.196.119 : AS43180 Trunk Networks LTD : Vancouver
-
195.178.110.199 : AS48090 Techoff Srv Limited : Bulgaria
-
195.178.110.223 : AS48090 Techoff Srv Limited : Bulgaria
-
195.178.110.242 : AS48090 Techoff Srv Limited : Bulgaria
-
195.178.110.31 : AS48090 Techoff Srv Limited : Bulgaria
-
195.63.22.95 : AS200373 3xK Tech GmbH : Berlin
-
198.134.110.103 : AS11990 Unlimited Net, LLC : Indpls
-
20.109.185.167 : AS8075 Microsoft Corporation : United States
-
20.120.93.234 : AS8075 Microsoft Corporation : Dulles
-
20.205.136.74 : AS8075 Microsoft Corporation : Hong Kong
-
20.212.4.51 : AS8075 Microsoft Corporation : Singapore
-
20.25.104.11 : AS8075 Microsoft Corporation : Dulles
-
208.84.100.38 : AS22295 Advin Services LLC : United States
-
209.145.54.142 : AS40021 Contabo Inc. : St Louis
-
213.152.176.252 : AS49453 Global Layer B.V. : The Netherlands
-
213.232.87.234 : AS136787 PacketHub S.A. : Amsterdam
-
216.144.249.201 : AS46475 Limestone Networks, Inc. : Frankfurt am Main
-
217.114.43.197 : AS210546 Chsl One Ltd : Moscow
-
23.101.132.31 : AS8075 Microsoft Corporation : Dulles
-
23.144.160.164 : AS32727 SB Professional Services : United States
-
3.238.186.214 : AS14618 Amazon.com, Inc. : Ashburn
-
34.124.196.112 : AS396982 Google LLC : Singapore
-
34.146.205.230 : AS396982 Google LLC : Tokyo
-
34.146.232.153 : AS396982 Google LLC : Tokyo
-
34.158.118.85 : AS396982 Google LLC : Groningen
-
34.179.179.98 : AS396982 Google LLC : Frankfurt am Main
-
34.40.45.3 : AS396982 Google LLC : Frankfurt am Main
-
34.63.76.199 : AS396982 Google LLC : Council Bluffs
-
34.83.80.74 : AS396982 Google LLC : The Dalles
-
34.85.216.224 : AS396982 Google LLC : Washington
-
35.194.192.3 : AS396982 Google LLC : Taipei
-
35.204.233.96 : AS396982 Google LLC : Groningen
-
35.240.61.234 : AS396982 Google LLC : Brussels
-
35.245.205.94 : AS396982 Google LLC : Washington
-
40.121.141.140 : AS8075 Microsoft Corporation : Dulles
-
40.71.56.65 : AS8075 Microsoft Corporation : Dulles
-
41.76.109.88 : AS327979 DIAMATRIX C.C : South Africa
-
45.138.12.68 : unknown : Lithuania
-
45.139.104.164 : AS399979 49.3 Networking LLC : Bulgaria
-
45.146.130.98 : AS13335 Cloudflare, Inc. : Seychelles
-
45.148.10.120 : AS48090 Techoff Srv Limited : Amsterdam
-
45.148.10.21 : AS48090 Techoff Srv Limited : Amsterdam
-
45.148.10.231 : AS48090 Techoff Srv Limited : Amsterdam
-
45.148.10.244 : AS48090 Techoff Srv Limited : Amsterdam
-
45.148.10.51 : AS48090 Techoff Srv Limited : Amsterdam
-
45.148.10.62 : AS48090 Techoff Srv Limited : Amsterdam
-
45.148.10.95 : AS48090 Techoff Srv Limited : Amsterdam
-
45.153.34.16 : AS197170 TechTies Inc. : Amsterdam
-
45.43.166.116 : AS203919 Lumadock Ltd : Bucharest
-
45.45.237.21 : AS400529 Infraly, LLC : Chicago
-
45.86.202.89 : AS206092 F.n.s. Holdings Limited : Frankfurt am Main
-
45.88.138.44 : AS213737 Ayosoft Ltd : Ukraine
-
5.255.107.253 : AS60404 The Infrastructure Group B.V. : Dronten
-
5.255.120.167 : AS60404 The Infrastructure Group B.V. : Dronten
-
5.255.121.146 : AS60404 The Infrastructure Group B.V. : Dronten
-
5.255.126.59 : AS60404 The Infrastructure Group B.V. : Dronten
-
5.62.57.86 : unknown : United States
-
5.8.35.76 : AS199524 G-Core Labs S.A. : Navi Mumbai
-
52.163.220.109 : AS8075 Microsoft Corporation : Singapore
-
54.161.133.201 : AS14618 Amazon.com, Inc. : Ashburn
-
66.187.5.19 : AS399804 Hostodo : Spokane
-
78.153.140.218 : AS202306 Hostglobal.plus Ltd : City of London
-
78.153.140.222 : AS202306 Hostglobal.plus Ltd : City of London
-
80.94.95.211 : AS204428 SS-Net : Romania
-
82.223.15.36 : AS8560 IONOS SE : Spain
-
82.39.206.154 : AS214481 Wojciech Czapkowicz : United Kingdom
-
83.147.52.49 : AS399486 12651980 CANADA INC. : Edison
-
85.11.167.49 : AS197170 TechTies Inc. : Amsterdam
-
85.121.240.110 : AS14315 1GSERVERS, LLC : Phoenix
-
88.151.33.237 : AS41608 NextGenWebs, S.L. : Dronten
-
91.199.147.230 : AS62212 SmartApe OU : Veselí nad Lužnicí
-
91.92.241.196 : AS202412 Omegatech LTD : Amsterdam
-
91.92.249.164 : AS62033 Cloudeus Sl : Paterna
-
91.92.42.120 : AS197170 TechTies Inc. : Amsterdam
-
91.92.42.63 : AS197170 TechTies Inc. : Amsterdam
-
92.48.89.160 : AS29550 Team Blue Carrier Limited : United Kingdom
-
93.123.109.246 : AS48090 Techoff Srv Limited : Bulgaria
-
93.152.221.13 : AS197170 TechTies Inc. : Frankfurt am Main
-
94.156.152.16 : AS214209 Internet Magnate (Pty) Ltd : Bulgaria
-
94.156.153.23 : AS202911 New Age Networks Ltd. : Bulgaria
-
94.26.90.191 : AS207043 Dedik Services Limited : Frankfurt am Main