Curl-url-http-3a-2f-2f169.254.169.254-2flatest-2fapi-2ftoken 【2025】

The string uses %3A for colon (:), %2F for forward slash (/). So:

Final decoded command:

curl http://169.254.169.254/latest/api/token

This is an AWS IMDSv2 (Instance Metadata Service Version 2) command. It requests a session token from the instance metadata service. curl-url-http-3A-2F-2F169.254.169.254-2Flatest-2Fapi-2Ftoken

AWS introduced IMDSv2 in late 2019 to mitigate this. The new flow:

IMDSv2 prevents HTTP redirect attacks and SSRF (Server-Side Request Forgery) that rely on simple GET requests without headers. The string uses %3A for colon ( :

169.254.169.254 is a link-local IP address used by major cloud providers (AWS, Google Cloud, Azure, and others) to serve instance metadata. This metadata includes:

In AWS IMDSv2 (the latest version), the workflow is: Final decoded command: curl http://169

However, the simplified command in your keyword:
curl http://169.254.169.254/latest/api/token — only fetches the token, not the credentials themselves. Still, in a real attack, once the attacker has this token, they can use it to fetch IAM credentials.