CI/CD and Cloud Credential File Grab for 2026-10-23

Oct 23, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

France: 14Belgium: 9The Netherlands: 6Bulgaria: 5Poland: 3Germany: 2Japan: 2Iran: 2United States: 2Lithuania: 2Singapore: 1Spain: 1Taiwan: 1Brazil: 1
France1427.5%
Belgium917.6%
The Netherlands611.8%
Bulgaria59.8%
Poland35.9%
Germany23.9%
Japan23.9%
Iran23.9%
United States23.9%
Lithuania23.9%
Singapore12.0%
Spain12.0%
Taiwan12.0%
Brazil12.0%

IP Address : ASN : City/Provider

  • 130.211.85.163 : AS396982 Google LLC : Brussels

  • 134.209.246.237 : AS14061 DigitalOcean, LLC : Frankfurt am Main

  • 136.110.106.71 : AS396982 Google LLC : Tokyo

  • 146.70.144.51 : AS9009 M247 Europe SRL : Warsaw

  • 152.42.249.165 : AS14061 DigitalOcean, LLC : Singapore

  • 185.177.72.10 : AS211590 Bucklog SARL : France

  • 185.177.72.115 : AS211590 Bucklog SARL : France

  • 185.177.72.13 : AS211590 Bucklog SARL : France

  • 185.177.72.144 : AS211590 Bucklog SARL : France

  • 185.177.72.16 : AS211590 Bucklog SARL : France

  • 185.177.72.201 : AS211590 Bucklog SARL : France

  • 185.177.72.22 : AS211590 Bucklog SARL : France

  • 185.177.72.23 : AS211590 Bucklog SARL : France

  • 185.177.72.236 : AS211590 Bucklog SARL : France

  • 185.177.72.30 : AS211590 Bucklog SARL : France

  • 185.177.72.51 : AS211590 Bucklog SARL : France

  • 185.177.72.52 : AS211590 Bucklog SARL : France

  • 185.177.72.56 : AS211590 Bucklog SARL : France

  • 185.93.89.60 : AS213790 Limited Network LTD : Iran

  • 195.178.110.152 : AS48090 Techoff Srv Limited : Bulgaria

  • 195.178.110.223 : AS48090 Techoff Srv Limited : Bulgaria

  • 195.178.110.242 : AS48090 Techoff Srv Limited : Bulgaria

  • 207.175.220.59 : AS396982 Google LLC : Brussels

  • 34.153.195.144 : AS396982 Google LLC : Tokyo

  • 34.175.101.46 : AS396982 Google LLC : Madrid

  • 34.182.244.125 : AS396982 Google LLC : Washington

  • 34.22.126.178 : AS396982 Google LLC : Brussels

  • 34.22.221.204 : AS396982 Google LLC : Brussels

  • 34.62.82.165 : AS396982 Google LLC : Brussels

  • 34.7.123.241 : AS396982 Google LLC : Groningen

  • 34.81.18.95 : AS396982 Google LLC : Taipei

  • 35.195.107.252 : AS396982 Google LLC : Brussels

  • 35.198.31.220 : AS396982 Google LLC : São Paulo

  • 35.205.169.234 : AS396982 Google LLC : Brussels

  • 35.241.178.74 : AS396982 Google LLC : Brussels

  • 45.128.38.237 : AS9009 M247 Europe SRL : Warsaw

  • 45.128.38.243 : AS9009 M247 Europe SRL : Warsaw

  • 45.138.12.27 : unknown : Lithuania

  • 45.138.12.68 : unknown : Lithuania

  • 45.148.10.119 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.154 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.174 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.21 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.148.10.231 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.45.237.39 : AS400529 Infraly, LLC : Chicago

  • 62.60.131.204 : AS208137 Feo Prest SRL : Tehran

  • 91.148.244.131 : AS34343 Eweka Internet Services B.V. : Brussels

  • 93.123.109.101 : AS48090 Techoff Srv Limited : Bulgaria

  • 93.123.109.214 : AS48090 Techoff Srv Limited : Bulgaria

Share on: