AWS Credentials File Grab for 2026-10-23

Oct 23, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

France: 25United States: 13The Netherlands: 12Belgium: 8Germany: 5Bulgaria: 5Russia: 3Iran: 3Lithuania: 3Japan: 2Singapore: 2Spain: 2Ukraine: 1Canada: 1Brazil: 1
France2529.1%
United States1315.1%
The Netherlands1214.0%
Belgium89.3%
Germany55.8%
Bulgaria55.8%
Russia33.5%
Iran33.5%
Lithuania33.5%
Japan22.3%
Singapore22.3%
Spain22.3%
Ukraine11.2%
Canada11.2%
Brazil11.2%

IP Address : ASN : City/Provider

  • 109.237.96.77 : AS210546 Chsl One Ltd : Russia

  • 130.211.85.163 : AS396982 Google LLC : Brussels

  • 134.209.246.237 : AS14061 DigitalOcean, LLC : Frankfurt am Main

  • 136.0.213.103 : AS19318 Interserver, Inc : Piscataway

  • 136.110.106.71 : AS396982 Google LLC : Tokyo

  • 143.244.186.78 : AS14061 DigitalOcean, LLC : Santa Clara

  • 152.42.249.165 : AS14061 DigitalOcean, LLC : Singapore

  • 159.65.142.5 : AS14061 DigitalOcean, LLC : Singapore

  • 173.239.240.27 : AS396356 Latitude.sh : Edison

  • 174.138.42.1 : AS14061 DigitalOcean, LLC : North Bergen

  • 176.126.103.125 : AS210546 Chsl One Ltd : Moscow

  • 176.65.132.217 : AS197170 TechTies Inc. : Amsterdam

  • 185.177.72.10 : AS211590 Bucklog SARL : France

  • 185.177.72.104 : AS211590 Bucklog SARL : France

  • 185.177.72.106 : AS211590 Bucklog SARL : France

  • 185.177.72.111 : AS211590 Bucklog SARL : France

  • 185.177.72.115 : AS211590 Bucklog SARL : France

  • 185.177.72.12 : AS211590 Bucklog SARL : France

  • 185.177.72.13 : AS211590 Bucklog SARL : France

  • 185.177.72.144 : AS211590 Bucklog SARL : France

  • 185.177.72.16 : AS211590 Bucklog SARL : France

  • 185.177.72.179 : AS211590 Bucklog SARL : France

  • 185.177.72.201 : AS211590 Bucklog SARL : France

  • 185.177.72.205 : AS211590 Bucklog SARL : France

  • 185.177.72.210 : AS211590 Bucklog SARL : France

  • 185.177.72.22 : AS211590 Bucklog SARL : France

  • 185.177.72.23 : AS211590 Bucklog SARL : France

  • 185.177.72.236 : AS211590 Bucklog SARL : France

  • 185.177.72.30 : AS211590 Bucklog SARL : France

  • 185.177.72.38 : AS211590 Bucklog SARL : France

  • 185.177.72.50 : AS211590 Bucklog SARL : France

  • 185.177.72.51 : AS211590 Bucklog SARL : France

  • 185.177.72.52 : AS211590 Bucklog SARL : France

  • 185.177.72.55 : AS211590 Bucklog SARL : France

  • 185.177.72.56 : AS211590 Bucklog SARL : France

  • 185.93.89.60 : AS213790 Limited Network LTD : Iran

  • 188.165.63.131 : AS16276 OVH SAS : France

  • 195.178.110.223 : AS48090 Techoff Srv Limited : Bulgaria

  • 195.178.110.242 : AS48090 Techoff Srv Limited : Bulgaria

  • 195.211.188.185 : AS203963 SPDNet Telekomunikasyon Hizmetleri Bilgi Teknolojileri Taahhut Sanayi Ve Ticaret A.S. : Ukraine

  • 198.134.110.103 : AS11990 Unlimited Net, LLC : Indpls

  • 20.118.218.222 : AS8075 Microsoft Corporation : Des Moines

  • 20.151.202.132 : AS8075 Microsoft Corporation : Toronto

  • 207.175.220.59 : AS396982 Google LLC : Brussels

  • 207.180.58.133 : AS213250 ITP-Solutions GmbH & Co. KG : Limburg an der Lahn

  • 213.232.87.234 : AS136787 PacketHub S.A. : Amsterdam

  • 217.114.43.119 : AS210546 Chsl One Ltd : Moscow

  • 3.88.40.214 : AS14618 Amazon.com, Inc. : Ashburn

  • 34.153.195.144 : AS396982 Google LLC : Tokyo

  • 34.173.28.158 : AS396982 Google LLC : Council Bluffs

  • 34.182.244.125 : AS396982 Google LLC : Washington

  • 34.22.126.178 : AS396982 Google LLC : Brussels

  • 34.22.221.204 : AS396982 Google LLC : Brussels

  • 34.62.82.165 : AS396982 Google LLC : Brussels

  • 35.195.107.252 : AS396982 Google LLC : Brussels

  • 35.198.31.220 : AS396982 Google LLC : São Paulo

  • 35.205.169.234 : AS396982 Google LLC : Brussels

  • 35.241.178.74 : AS396982 Google LLC : Brussels

  • 45.138.12.27 : unknown : Lithuania

  • 45.138.12.52 : unknown : Lithuania

  • 45.138.12.68 : unknown : Lithuania

  • 45.148.10.119 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.154 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.174 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.21 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.231 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.238 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.153.34.43 : AS197170 TechTies Inc. : Amsterdam

  • 45.156.87.246 : AS197170 TechTies Inc. : Amsterdam

  • 45.45.237.39 : AS400529 Infraly, LLC : Chicago

  • 45.86.202.140 : AS206092 F.n.s. Holdings Limited : Frankfurt am Main

  • 54.161.133.201 : AS14618 Amazon.com, Inc. : Ashburn

  • 62.233.51.166 : unknown : Chicago

  • 62.60.131.204 : AS208137 Feo Prest SRL : Tehran

  • 62.60.131.229 : AS208137 Feo Prest SRL : Tehran

  • 79.127.171.241 : AS60068 Datacamp Limited : Amsterdam

  • 85.11.167.138 : AS197170 TechTies Inc. : Amsterdam

  • 93.123.109.101 : AS48090 Techoff Srv Limited : Bulgaria

  • 93.123.109.214 : AS48090 Techoff Srv Limited : Bulgaria

  • 93.123.109.246 : AS48090 Techoff Srv Limited : Bulgaria

  • 94.26.90.191 : AS207043 Dedik Services Limited : Frankfurt am Main

  • 95.173.216.42 : AS60068 Datacamp Limited : Dallas

Share on: