CI/CD and Cloud Credential File Grab for 2026-10-22
Last Updated: 00:00 UTC
Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files
Observed URIs
Attackers by Country
| France | 13 | 26.0% |
| United States | 9 | 18.0% |
| Seychelles | 8 | 16.0% |
| The Netherlands | 4 | 8.0% |
| Belgium | 4 | 8.0% |
| United Arab Emirates | 3 | 6.0% |
| Bulgaria | 2 | 4.0% |
| Germany | 2 | 4.0% |
| Lithuania | 2 | 4.0% |
| Switzerland | 1 | 2.0% |
| Singapore | 1 | 2.0% |
| Taiwan | 1 | 2.0% |
IP Address : ASN : City/Provider
-
104.28.215.225 : AS13335 Cloudflare, Inc. : Omaha
-
109.202.99.46 : AS49453 Global Layer B.V. : The Netherlands
-
154.83.103.104 : unknown : Seychelles
-
154.83.103.108 : unknown : Seychelles
-
154.83.103.111 : unknown : Seychelles
-
154.83.103.113 : unknown : Seychelles
-
154.83.103.115 : unknown : Seychelles
-
154.83.103.204 : unknown : Seychelles
-
154.83.103.210 : unknown : Seychelles
-
185.177.72.10 : AS211590 Bucklog SARL : France
-
185.177.72.108 : AS211590 Bucklog SARL : France
-
185.177.72.113 : AS211590 Bucklog SARL : France
-
185.177.72.179 : AS211590 Bucklog SARL : France
-
185.177.72.201 : AS211590 Bucklog SARL : France
-
185.177.72.22 : AS211590 Bucklog SARL : France
-
185.177.72.236 : AS211590 Bucklog SARL : France
-
185.177.72.38 : AS211590 Bucklog SARL : France
-
185.177.72.7 : AS211590 Bucklog SARL : France
-
185.177.72.9 : AS211590 Bucklog SARL : France
-
193.41.206.176 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
193.41.206.202 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
193.41.206.24 : AS44947 Amwaj Alkhyr Commercial Brokers Co. : United Arab Emirates
-
195.178.110.159 : AS48090 Techoff Srv Limited : Bulgaria
-
195.178.110.242 : AS48090 Techoff Srv Limited : Bulgaria
-
196.251.90.93 : unknown : Seychelles
-
207.175.36.176 : AS396982 Google LLC : Brussels
-
213.152.176.252 : AS49453 Global Layer B.V. : The Netherlands
-
213.232.87.232 : AS136787 PacketHub S.A. : Amsterdam
-
23.252.112.35 : AS18450 WebNX, Inc. : United States
-
34.12.31.198 : AS396982 Google LLC : Groningen
-
34.148.192.82 : AS396982 Google LLC : North Charleston
-
34.169.38.101 : AS396982 Google LLC : The Dalles
-
34.32.40.152 : AS396982 Google LLC : Berlin
-
34.40.50.130 : AS396982 Google LLC : Frankfurt am Main
-
34.48.32.16 : AS396982 Google LLC : Washington
-
34.50.185.87 : AS396982 Google LLC : Las Vegas
-
34.65.74.105 : AS396982 Google LLC : Zurich
-
34.75.118.13 : AS396982 Google LLC : North Charleston
-
34.79.167.55 : AS396982 Google LLC : Brussels
-
35.180.31.250 : AS16509 Amazon.com, Inc. : Paris
-
35.181.153.44 : AS16509 Amazon.com, Inc. : Paris
-
35.241.173.5 : AS396982 Google LLC : Brussels
-
35.241.202.92 : AS396982 Google LLC : Brussels
-
43.134.75.111 : AS132203 Tencent Building, Kejizhongyi Avenue : Singapore
-
45.138.12.178 : unknown : Lithuania
-
45.138.12.68 : unknown : Lithuania
-
45.45.237.69 : AS400529 Infraly, LLC : Chicago
-
45.45.237.77 : AS400529 Infraly, LLC : Chicago
-
61.224.104.23 : AS3462 Data Communication Business Group : Changhua
-
77.132.88.57 : AS15557 Societe Francaise Du Radiotelephone - SFR SA : France