TL;DR: A custom Boto3 user_agent_extra suffix, iam_masscek/2.0, observed
validating stolen AWS credentials against a Thinkst Canarytoken. As of
2026-07-30 this string appears in no public threat feed, GitHub repository, or
vendor report.
| Date (UTC) | Source IP | ASN | Event |