AWS Credentials File Grab for 2026-10-22
Last Updated: 00:00 UTC
Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API
Observed URIs
Attackers by Country
| France | 19 | 17.1% |
| United States | 18 | 16.2% |
| Seychelles | 14 | 12.6% |
| The Netherlands | 9 | 8.1% |
| United Arab Emirates | 8 | 7.2% |
| Canada | 5 | 4.5% |
| Russia | 5 | 4.5% |
| Bulgaria | 5 | 4.5% |
| Lithuania | 4 | 3.6% |
| Belgium | 4 | 3.6% |
| Germany | 4 | 3.6% |
| United Kingdom | 3 | 2.7% |
| Singapore | 3 | 2.7% |
| Austria | 1 | 0.9% |
| India | 1 | 0.9% |
| Japan | 1 | 0.9% |
| Iran | 1 | 0.9% |
| Brazil | 1 | 0.9% |
| Sweden | 1 | 0.9% |
| Australia | 1 | 0.9% |
| Spain | 1 | 0.9% |
| Türkiye | 1 | 0.9% |
| Georgia | 1 | 0.9% |
IP Address : ASN : City/Provider
-
104.207.53.221 : AS200373 3xK Tech GmbH : City of London
-
104.28.215.225 : AS13335 Cloudflare, Inc. : Omaha
-
109.202.99.46 : AS49453 Global Layer B.V. : The Netherlands
-
109.70.100.33 : AS208323 Foundation for Applied Privacy : Vienna
-
13.203.154.127 : AS16509 Amazon.com, Inc. : Mumbai
-
135.125.182.43 : AS16276 OVH SAS : France
-
140.245.46.21 : AS31898 Oracle Corporation : Singapore
-
141.98.11.152 : AS209605 UAB Host Baltic : Vilnius
-
154.83.103.10 : unknown : Seychelles
-
154.83.103.104 : unknown : Seychelles
-
154.83.103.108 : unknown : Seychelles
-
154.83.103.111 : unknown : Seychelles
-
154.83.103.113 : unknown : Seychelles
-
154.83.103.115 : unknown : Seychelles
-
154.83.103.16 : unknown : Seychelles
-
154.83.103.19 : unknown : Seychelles
-
154.83.103.200 : unknown : Seychelles
-
154.83.103.204 : unknown : Seychelles
-
154.83.103.207 : unknown : Seychelles
-
154.83.103.210 : unknown : Seychelles
-
167.114.165.168 : AS16276 OVH SAS : Montreal
-
170.39.218.109 : AS52053 REDHEBERG Association declaree : Canada
-
170.39.218.176 : AS52053 REDHEBERG Association declaree : Canada
-
170.39.218.72 : AS52053 REDHEBERG Association declaree : Canada
-
176.126.103.125 : AS210546 Chsl One Ltd : Moscow
-
18.212.122.225 : AS14618 Amazon.com, Inc. : Ashburn
-
18.216.94.151 : AS16509 Amazon.com, Inc. : Columbus
-
185.177.72.10 : AS211590 Bucklog SARL : France
-
185.177.72.106 : AS211590 Bucklog SARL : France
-
185.177.72.108 : AS211590 Bucklog SARL : France
-
185.177.72.111 : AS211590 Bucklog SARL : France
-
185.177.72.113 : AS211590 Bucklog SARL : France
-
185.177.72.115 : AS211590 Bucklog SARL : France
-
185.177.72.144 : AS211590 Bucklog SARL : France
-
185.177.72.179 : AS211590 Bucklog SARL : France
-
185.177.72.201 : AS211590 Bucklog SARL : France
-
185.177.72.204 : AS211590 Bucklog SARL : France
-
185.177.72.22 : AS211590 Bucklog SARL : France
-
185.177.72.236 : AS211590 Bucklog SARL : France
-
185.177.72.38 : AS211590 Bucklog SARL : France
-
185.177.72.7 : AS211590 Bucklog SARL : France
-
185.177.72.9 : AS211590 Bucklog SARL : France
-
185.196.9.254 : unknown : unknown
-
185.54.229.51 : AS137409 GSL Networks Pty LTD : Japan
-
185.93.89.97 : AS213790 Limited Network LTD : Iran
-
193.41.206.12 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
193.41.206.176 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
193.41.206.189 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
193.41.206.202 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
193.41.206.246 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
193.41.206.36 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
193.41.206.98 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
194.42.196.119 : AS43180 Trunk Networks LTD : Vancouver
-
195.178.110.159 : AS48090 Techoff Srv Limited : Bulgaria
-
195.178.110.18 : AS48090 Techoff Srv Limited : Bulgaria
-
195.178.110.242 : AS48090 Techoff Srv Limited : Bulgaria
-
196.251.90.93 : unknown : Seychelles
-
20.10.14.52 : AS8075 Microsoft Corporation : Boydton
-
20.14.102.50 : AS8075 Microsoft Corporation : Phoenix
-
20.212.25.130 : AS8075 Microsoft Corporation : Singapore
-
20.24.56.102 : AS8075 Microsoft Corporation : Singapore
-
207.175.36.176 : AS396982 Google LLC : Brussels
-
212.102.33.165 : AS60068 Datacamp Limited : New York
-
213.152.176.252 : AS49453 Global Layer B.V. : The Netherlands
-
213.209.143.30 : unknown : Germany
-
213.232.87.232 : AS136787 PacketHub S.A. : Amsterdam
-
213.232.87.234 : AS136787 PacketHub S.A. : Amsterdam
-
216.26.242.95 : AS200373 3xK Tech GmbH : São Paulo
-
217.114.43.161 : AS210546 Chsl One Ltd : Moscow
-
217.160.33.10 : AS8560 IONOS SE : Germany
-
23.252.112.35 : AS18450 WebNX, Inc. : United States
-
31.57.159.126 : unknown : Russia
-
31.58.51.38 : AS214481 Wojciech Czapkowicz : United Arab Emirates
-
34.12.31.198 : AS396982 Google LLC : Groningen
-
34.148.192.82 : AS396982 Google LLC : North Charleston
-
34.169.38.101 : AS396982 Google LLC : The Dalles
-
34.40.50.130 : AS396982 Google LLC : Frankfurt am Main
-
34.48.32.16 : AS396982 Google LLC : Washington
-
34.50.185.87 : AS396982 Google LLC : Las Vegas
-
34.75.118.13 : AS396982 Google LLC : North Charleston
-
34.79.167.55 : AS396982 Google LLC : Brussels
-
35.168.112.38 : AS14618 Amazon.com, Inc. : Ashburn
-
35.180.31.250 : AS16509 Amazon.com, Inc. : Paris
-
35.181.153.44 : AS16509 Amazon.com, Inc. : Paris
-
35.241.173.5 : AS396982 Google LLC : Brussels
-
35.241.202.92 : AS396982 Google LLC : Brussels
-
37.60.255.55 : AS51167 Contabo GmbH : Lauterbourg
-
43.166.137.66 : AS132203 Tencent Building, Kejizhongyi Avenue : Ashburn
-
45.138.12.178 : unknown : Lithuania
-
45.138.12.52 : unknown : Lithuania
-
45.138.12.68 : unknown : Lithuania
-
45.139.104.164 : AS399979 49.3 Networking LLC : Bulgaria
-
45.146.130.98 : AS13335 Cloudflare, Inc. : Seychelles
-
45.148.10.62 : AS48090 Techoff Srv Limited : Amsterdam
-
45.153.34.249 : AS197170 TechTies Inc. : Amsterdam
-
45.156.87.12 : AS197170 TechTies Inc. : Amsterdam
-
45.45.237.69 : AS400529 Infraly, LLC : Chicago
-
45.45.237.77 : AS400529 Infraly, LLC : Chicago
-
45.86.202.89 : AS206092 F.n.s. Holdings Limited : Frankfurt am Main
-
5.62.57.86 : unknown : United States
-
51.12.240.96 : AS8075 Microsoft Corporation : Sweden
-
52.177.68.63 : AS8075 Microsoft Corporation : Boydton
-
52.63.44.47 : AS16509 Amazon.com, Inc. : Sydney
-
78.153.140.218 : AS202306 Hostglobal.plus Ltd : City of London
-
78.153.140.222 : AS202306 Hostglobal.plus Ltd : City of London
-
82.223.21.24 : AS8560 IONOS SE : Spain
-
87.251.78.138 : AS210546 Chsl One Ltd : Moscow
-
87.251.78.46 : AS210546 Chsl One Ltd : Moscow
-
88.214.43.118 : AS51559 Netinternet Bilisim Teknolojileri AS : Türkiye
-
91.209.135.71 : AS210546 Chsl One Ltd : Georgia
-
94.156.153.23 : AS202911 New Age Networks Ltd. : Bulgaria