What they tried
| Intent | Calls | Addresses |
|---|---|---|
| checked the key is alive | 100 | 30 |
| mapped servers storage and secrets | 84 | 14 |
| looked for AI models to run on our bill | 57 | 39 |
| looked for email and SMS sending | 40 | 25 |
| tried to stay in | 3 | 3 |
39 addresses went for AI models. 2 of them checked the key was alive from the same address before the first model call.
Which tools they used
| Tool from the user agent | Calls |
|---|---|
| Python urllib | 75 |
| Python boto3 | 61 |
| AWS SDK for .NET | 34 |
| Python httpx | 28 |
| AWS CLI | 20 |
| AWS SDK for Go | 20 |
| TruffleHog | 14 |
| Go | 11 |
Tool names come from the user agent and a caller can fake it.
Where they came from
| Hosting network | Calls |
|---|---|
| netcup | 100 |
| Google Cloud | 30 |
| Datacamp | 14 |
| Techoff SRV | 14 |
| M247 | 8 |
| Cloudflare | 7 |
| WS Telecom | 7 |
| 31173 Services | 5 |
55 of the 91 addresses belong to hosting companies and we name those networks. One address on netcup alone made 100 of the 284 calls. The rest are consumer or carrier connections. We do not name those providers and we show only the first three parts of the address because a home line may be someone's infected machine.
Addresses that came back
22 addresses used a key three times or more. One row per address. We do not group addresses into actors because the evidence does not support it.
| Address | Network | Country | Uses | What it did |
|---|---|---|---|---|
152.53.236.20 | netcup | DE | 100 | checked the key is alive / looked for email and SMS sending / mapped servers storage and secrets |
71.83.210.0/24 | consumer or carrier network | US | 14 | checked the key is alive |
34.156.22.151 | Google Cloud | BE | 9 | looked for email and SMS sending / mapped servers storage and secrets / tried to stay in |
138.199.15.176 | Datacamp | FR | 7 | checked the key is alive / looked for AI models to run on our bill |
35.241.239.86 | Google Cloud | BE | 7 | looked for email and SMS sending / mapped servers storage and secrets |
34.52.133.111 | Google Cloud | BE | 7 | looked for email and SMS sending / mapped servers storage and secrets |
91.200.212.0/24 | consumer or carrier network | CA | 5 | looked for AI models to run on our bill |
195.178.110.159 | Techoff SRV | NL | 5 | looked for email and SMS sending |
108.62.160.144 | Leaseweb | US | 5 | checked the key is alive / looked for AI models to run on our bill / mapped servers storage and secrets |
94.154.43.0/24 | consumer or carrier network | NL | 5 | looked for AI models to run on our bill |
93.123.109.101 | Techoff SRV | NL | 5 | checked the key is alive / looked for AI models to run on our bill / looked for email and SMS sending |
13.250.110.222 | Amazon AWS | SG | 4 | checked the key is alive / tried to stay in |
34.140.132.132 | Google Cloud | BE | 4 | looked for email and SMS sending / mapped servers storage and secrets |
84.233.212.9 | Datacamp | US | 4 | mapped servers storage and secrets |
45.138.12.23 | TC Datacenter | NL | 4 | looked for email and SMS sending / mapped servers storage and secrets |
193.32.126.141 | 31173 Services | FR | 4 | checked the key is alive / mapped servers storage and secrets |
91.90.123.9 | M247 | BE | 3 | checked the key is alive / looked for email and SMS sending |
91.200.214.0/24 | consumer or carrier network | CA | 3 | looked for AI models to run on our bill |
34.156.121.46 | Google Cloud | BE | 3 | mapped servers storage and secrets |
88.187.63.0/24 | consumer or carrier network | FR | 3 | checked the key is alive / looked for email and SMS sending |
144.172.118.88 | RouterHosting | US | 3 | checked the key is alive / looked for email and SMS sending |
2.57.122.80 | Unmanaged Ltd | RO | 3 | looked for email and SMS sending |
Fetches versus uses
Our edge logs saw about 740 successful fetches of the decoy files in the same week. That count is sampled and a fetch is not a use. We cannot link a fetch to a later call so we do not claim a ratio.
What to do this week
- Treat a key that ever sat in a public file as used. Rotate it the same day and read its CloudTrail.
- Turn on Bedrock model invocation logging and set a budget alarm even if you never use Bedrock.
- Deny Bedrock and SES in an SCP for any account that has no reason to call them.
- Scan repos and agent config folders for keys before they ship. Our scanner is free and runs locally.
Install it with pip install sunglasses and read the install guide.
How we counted
The keys are canary credentials from a commercial canary service. They carry no permissions. Each use raises an alert with the AWS call name and the source address and we store those in a ledger. Counts here are exact alerts inside the window in UTC. Networks are named from the ASN record. Tool names come from the user agent which a caller can fake.
Consumer addresses are masked to the first three parts because a home line may be someone's infected machine. We name hosting networks only.