Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
4 rows of base64-like lines, lines 14-23 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
14gV0NymYY0wDQYJKoZIhvcNAQEL\nBQAwfjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBg⟨U+000D⟩
VBAcM\nB1NlYXR0bGUxGDAWBgNVBAoMD0FtYXpvbi5jb20gSW5jLjEgMB4GA1UECwwXQW1h\nem9uIElvVCBQcm9⟨U+000D⟩
2aXNpb25pbmcxDDAKBgNVBAUTAzEuMDAeFw0yMDA3MjgxNjQ0\nMDZaFw0yMDA3MjgxNjUxMDZaMEsxSTBHBgNVB
-
base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
KCAQEAwYSiPeJLSi6k8J4/msjq\ntUwCbfzerOiCQ2b5a2I5AtBO8M2nmN06a1pNN0tvb1M1bhDlx10F2W4oYKYN⟨U+000D⟩
pun8\n2pFpvf8KY8xPZ8ufsZDxlR+Fp8M+8iuZvEtGoC0/enEQUlp1pqJzlnWNBilc54tA\ngPoshrnYKxSpuxGn⟨U+000D⟩
v79fKF63/NirTgBjuMRtChNlimEXAMPLE3PcWYZVz/3ly4b9\nNPpRqdFlcPT24Sn68ZYiieaurC+Z1VGlB6uoZU
-
6 rows of base64-like lines, lines 36-51 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
msjqtUwCbfzerOiCQ2b5a2I5AtBO8M2n\nmN06a1pNN0tvb1M1bhDlx10F2W4oYKYNpun82pFpvf8KY8xPZ8ufsZ⟨U+000D⟩
DxlR+Fp8M+\n8iuZvEtGoC0/enEQUlp1pqJzlnWNBilc54tAgPoshrnYKxSpuxGnv79fKF63/Nir\nTgBjuMRtCh⟨U+000D⟩
NlimB7E9X8d3PcWYZVz/3ly4b9NPpRqdFlcPT24Sn68ZYiieaurC+Z\n1VGlB6uoZUD2MLAE3jrwKd7tGpOc4E8i
-
6 rows of base64-like lines, lines 17-17 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"FIRST_KEY": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1uJOB4lQPgG/lM6ZfIwo\nZ+7ENxAio9q6QD4FFqjGZsvjtYwjoe1RKK0U8Eq9xb5O3kRSmyIwTzwzm/f4Gf0Y\nZUloJ+t3PUUwHrmbYTAgTrCUgRFygjfgVwGCPs5ZAX4Eyqt5cr+AIHIiUDbxSa7p\nzwOBKPeic0asNJpqT8PkBbRaKyleJh5oo81NDHHmVtbBm5A5YiJjqYXLaVAowKzZ\n+GqsN
-
15 rows of base64-like lines, lines 15-15 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"certificatePem": "-----BEGIN CERTIFICATE-----\nMIICzzCCAbegEXAMPLEJANVEPWXl8taPMA0GCSqGSIb3DQEBBQUAMB4xCzAJBgNV\nBAYTAlVTMQ8wDQYDVQQKDAZBbWF6b24wHhcNMTkwOTI0MjEzMTE1WhcNMjkwOTIx\nMjEzMTE1WjAeMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMIIBIjANBgkq\nhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzd3R3ioalCS0MhFWfBrVGR036EK07UAf\nVdz9E
-
base64-like blob (64 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
--parameters '{"ThingName":"Register-thing-trial-1","AWS::IoT::Certificate::Id":"799a9ea048a1e6aea42b55EXAMPLEf8697b4bafcd77a318a3068e30404b9233c"}'⟨U+000D⟩
⟨U+000D⟩
Output::
-
4 rows of base64-like lines, lines 14-23 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
HiOJ2jNjboIwDQYJKoZIhvcNAQEL\nBQAwTTFLMEkGA1UECwxCQW1hem9uIFdlYiBTZXJ2aWNlcyBPPUFtYXpvbi⟨U+000D⟩
5jb20g\nSW5jLiBMPVNlYXR0bGUgU1Q9V2FzaGluZ3RvbiBDPVVTMB4XDTIwMDcyMzE2NDUw\nOVoXDTQ5MTIzMT⟨U+000D⟩
IzNTk1OVowHjEcMBoGA1UEAwwTQVdTIElvVCBDZXJ0aWZpY2F0\nZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-
base64-like blob (69 bytes, compression ratio 1.01) (raw pass, confidence 0.60)
"resourceArns": {⟨U+000D⟩
"certificate": "arn:aws:iot:us-west-2:571032923833:cert/799a9ea048a1e6aea42b55EXAMPLEf8697b4bafcd77a318a3068e30404b9233c",⟨U+000D⟩
"thing": "arn:aws:iot:us-west-2:571032923833:thing/Register-thing-trial-1"⟨U+000D⟩
}
-
base64-like blob (344 bytes, compression ratio 0.84) (raw pass, confidence 0.60)
--token-signature "mE0GvaHqy9nER/FdgtJX5lXYEJ3b3vE7t1gEszc0TKGgLKWXTnPkb2AbKnOAZ8lGyoN5dVtWDWVmr25m7++zjbYIMk2TBvyGXhOmvKFBPkdgyA43KL6SiZy0cTqlPMcQDsP7VX2rXr7CTowCxSNKphGXdQe0/I5dQ+JO6KUaHwCmupt0/MejKtaNwiia064j6wprOAUwG5S1IYFuRd0X+wfo8pb0DubAIX1Ua705kuhRUcTx4SxUShEYKmN4IDEvLB6FsIr0B2wvB7y4iPmcajxzGl02ExvyCUNct
-
22 rows of base64-like lines, lines 13-34 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"ServerTrust": "-----BEGIN CERTIFICATE-----\n⟨U+000D⟩
MIIESTCCAzGgAwIBAgITBn+UV4WH6Kx33rJTMlu8mYtWDTANBgkqhkiG9w0BAQsF\n⟨U+000D⟩
ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6\n⟨U+000D⟩
b24gUm9vdCBDQSAxMB4XDTE1MTAyMjAwMDAwMFoXDTI1MTAxOTAwMDAwMFowRjEL\n
-
base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"name": "",⟨U+000D⟩
"publicKeyMaterial": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEqVWUtqs6EktQMR1sCYmEzGvRwtaycI16\n9pmzcpiWu/uhNStGlteJ5odRfRwVkoQUMnSZXTCcbn9bBTTmiWo4mJcFOOAzsthH\n0UAb8NdD4tUE0At4a9hYP9IETEXAMPLE\n-----END PUBLIC KEY-----",
-
base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"name": "",⟨U+000D⟩
"publicKeyMaterial": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEqVWUtqs6EktQMR1sCYmEzGvRwtaycI16\n9pmzcpiWu/uhNStGlteJ5odRfRwVkoQUMnSZXTCcbn9bBTTmiWo4mJcFOOAzsthH\n0UAb8NdD4tUE0At4a9hYP9IETEXAMPLE\n-----END PUBLIC KEY-----",
-
base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"name": "",⟨U+000D⟩
"publicKeyMaterial": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEqVWUtqs6EktQMR1sCYmEzGvRwtaycI16\n9pmzcpiWu/uhNStGlteJ5odRfRwVkoQUMnSZXTCcbn9bBTTmiWo4mJcFOOAzsthH\n0UAb8NdD4tUE0At4a9hYP9IETEXAMPLE\n-----END PUBLIC KEY-----",
-
base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"name": "",⟨U+000D⟩
"publicKeyMaterial": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEqVWUtqs6EktQMR1sCYmEzGvRwtaycI16\n9pmzcpiWu/uhNStGlteJ5odRfRwVkoQUMnSZXTCcbn9bBTTmiWo4mJcFOOAzsthH\n0UAb8NdD4tUE0At4a9hYP9IETEXAMPLE\n-----END PUBLIC KEY-----",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"tags": {},
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "BA1C2defGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"tags": {},
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "BA1C2defGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2edfGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"tags": {}
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "BA1C2defGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2edfGHijkLMNo3PqQRstUvwxyzaBCDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaCBDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaBCDeFghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaCBDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (69 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"endpoint": "a1b2c3d4e5f6.srt.live-video.net",⟨U+000D⟩
"passphrase": "AB1C2defGHijkLMNo3PqQRstUvwxyzaCBDEfghh4ijklMN5opqrStuVWxyzAbCDEfghIJ"⟨U+000D⟩
},⟨U+000D⟩
"ingestEndpoint": "a1b2c3d4e5f6.global-contribute.live-video.net",
-
base64-like blob (224 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
aws kinesis get-records \
--shard-iterator AAAAAAAAAAF7/0mWD7IuHj1yGv/TKuNgx2ukD5xipCY4cy4gU96orWwZwcSXh3K9tAmGYeOZyLZrvzzeOFVf9iN99hUPw/w/b0YWYeehfNvnf1DYt5XpDJghLKr3DzgznkTmMymDP3R+3wRKeuEw6/kdxY2yKJH0veaiekaVc4N2VwK/GvaGP2Hh9Fg7N++q0Adg6fIDQPt4p8RpavDbk+A4sL9SWGE1
Output::
-
base64-like blob (224 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
{
"ShardIterator": "AAAAAAAAAAFEvJjIYI+3jw/4aqgH9FifJ+n48XWTh/IFIsbILP6o5eDueD39NXNBfpZ10WL5K6ADXk8w+5H+Qhd9cFA9k268CPXCz/kebq1TGYI7Vy+lUkA9BuN3xvATxMBGxRY3zYK05gqgvaIRn94O8SqeEqwhigwZxNWxID3Ej7YYYcxQi8Q/fIrCjGAy/n2r5Z9G864YpWDfN9upNNQAR/iiOWKs"
}
-
base64-like blob (63 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
--xks-proxy-uri-path "/example-prefix/kms/xks/v1" \⟨U+000D⟩
--xks-proxy-authentication-credential "AccessKeyId=ABCDE12345670EXAMPLE, RawSecretAccessKey=DXjSUawnel2fr6SKC7G25CNxTyWKE5PF9XX6H/u9pSo="
-
base64-like blob (63 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
--xks-proxy-vpc-endpoint-service-name "com.amazonaws.vpce.us-east-1.vpce-svc-example1" \⟨U+000D⟩
--xks-proxy-authentication-credential "AccessKeyId=ABCDE12345670EXAMPLE, RawSecretAccessKey=DXjSUawnel2fr6SKC7G25CNxTyWKE5PF9XX6H/u9pSo="⟨U+000D⟩
⟨U+000D⟩
Output::
-
base64-like blob (203 bytes, compression ratio 0.92) (raw pass, confidence 0.60)
--key-agreement-algorithm ECDH \⟨U+000D⟩
--public-key "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvH3Yj0wbkLEpUl95Cv1cJVjsVNSjwGq3tCLnzXfhVwVvmzGN8pYj3U8nKwgouaHbBWNJYjP5VutbbkKS4Kv4GojwZBJyHN17kmxo8yTjRmjR15SKIQ8cqRA2uaERMLnpztIXdZp232PQPbWGxDyXYJ0aJ5EFSag"⟨U+000D⟩
⟨U+000D⟩
Output::
-
base64-like blob (96 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
"KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",⟨U+000D⟩
"SharedSecret": "MEYCIQCKZLWyTk5runarx6XiAkU9gv3lbwPO/pHa+DXFehzdDwIhANwpsIV2g/9SPWLLsF6p/hiSskuIXMTRwqrMdVKWTMHG",⟨U+000D⟩
"KeyAgreementAlgorithm": "ECDH",⟨U+000D⟩
"KeyOrigin": "AWS_KMS"
-
base64-like blob (102 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
{
"PrivateKeyCiphertextBlob": "AQIDAHi6LtupRpdKl2aJTzkK6FbhOtQkMlQJJH3PdtHvS/y+hAFFxmiD134doUDzMGmfCEtcAAAHaTCCB2UGCSqGSIb3DQEHBqCCB1...",
"PublicKey": "MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA3A3eGMyPrvSn7+LdlJE1oUoQV5HpEuHAVbdOyND+NmYDH/mL1OSIEuLrcdZ5hrMH4pk83r40l...",
-
base64-like blob (117 bytes, compression ratio 1.09) (raw pass, confidence 0.60)
"PublicKey": "MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA3A3eGMyPrvSn7+LdlJE1oUoQV5HpEuHAVbdOyND+NmYDH/mL1OSIEuLrcdZ5hrMH4pk83r40l...",
"KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
-
base64-like blob (102 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
{
"PrivateKeyCiphertextBlob": "AQIDAHi6LtupRpdKl2aJTzkK6FbhOtQkMlQJJH3PdtHvS/y+hAFFxmiD134doUDzMGmfCEtcAAAHaTCCB2UGCSqGSIb3DQEHBqCCB1...",
"PrivateKeyPlaintext": "MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDcDd4YzI+u9Kfv4t2UkTWhShBXkekS4cBVt07I0P42ZgMf+YvU5IgS4ut...",
-
base64-like blob (107 bytes, compression ratio 1.01) (raw pass, confidence 0.60)
"PrivateKeyPlaintext": "MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDcDd4YzI+u9Kfv4t2UkTWhShBXkekS4cBVt07I0P42ZgMf+YvU5IgS4ut...",
"PublicKey": "MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA3A3eGMyPrvSn7+LdlJE1oUoQV5HpEuHAVbdOyND+NmYDH/mL1OSIEuLrcdZ5hrMH4pk83r40l...",
-
base64-like blob (117 bytes, compression ratio 1.09) (raw pass, confidence 0.60)
"PublicKey": "MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA3A3eGMyPrvSn7+LdlJE1oUoQV5HpEuHAVbdOyND+NmYDH/mL1OSIEuLrcdZ5hrMH4pk83r40l...",
"KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
-
base64-like blob (126 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
{
"CiphertextBlob": "AQEDAHjRYf5WytIc0C857tFSnBaPn2F8DgfmThbJlGfR8P3WlwAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDEFogL",
"KeyId": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
{
"Plaintext": "VdzKNHGzUAzJeRBVY+uUmofUGGiDzyB3+i9fVkh3piw=",
"KeyId": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
-
base64-like blob (224 bytes, compression ratio 0.88) (raw pass, confidence 0.60)
"CiphertextBlob": "AQEDAHjRYf5WytIc0C857tFSnBaPn2F8DgfmThbJlGfR8P3WlwAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDEFogLqPWZconQhwHAIBEIA7d9AC7GeJJM34njQvg4Wf1d5sw0NIo1MrBqZa+YdhV8MrkBQPeac0ReRVNDt9qleAt+SHgIRF8P0H+7U="
}
-
base64-like blob (123 bytes, compression ratio 1.02) (raw pass, confidence 0.60)
{
"CiphertextBlob": "AQIBAHi6LtupRpdKl2aJTzkK6FbhOtQkMlQJJH3PdtHvS/y+hAEnX/QQNmMwDfg2korNMEc8AAACaDCCAmQGCSqGSIb3DQEHBqCCAlUwggJRAgEAMIICSgYJKoZ...",
"Plaintext": "ty8Lr0Bk6OF07M2BWt6qbFdNB+G00ZLtf5MSEb4al3R2UKWGOp06njAwy2n72VRm2m7z/Pm9Wpbvttz6a4lSo9hgPvKhZ5y6RTm4OovEXiVfBveyX3DQxDzRSwbKDPk/...",
-
base64-like blob (128 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
"Plaintext": "ty8Lr0Bk6OF07M2BWt6qbFdNB+G00ZLtf5MSEb4al3R2UKWGOp06njAwy2n72VRm2m7z/Pm9Wpbvttz6a4lSo9hgPvKhZ5y6RTm4OovEXiVfBveyX3DQxDzRSwbKDPk/...",
"KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
-
base64-like blob (66 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",⟨U+000D⟩
"PublicKey": "jANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAl5epvg1/QtJhxSi2g9SDEVg8QV/...",⟨U+000D⟩
"CustomerMasterKeySpec": "RSA_4096",⟨U+000D⟩
"KeyUsage": "ENCRYPT_DECRYPT",
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",⟨U+000D⟩
"Signature": "ABCDEFhpyVYyTxbafE74ccSvEJLJr3zuoV1Hfymz4qv+/fxmxNLA7SE1SiF8lHw80fKZZ3bJ...",⟨U+000D⟩
"SigningAlgorithm": "RSASSA_PKCS1_V1_5_SHA_256"⟨U+000D⟩
}
-
base64-like blob (63 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
--custom-key-store-id cks-1234567890abcdef0 \⟨U+000D⟩
--xks-proxy-authentication-credential "AccessKeyId=ABCDE12345670EXAMPLE, RawSecretAccessKey=DXjSUawnel2fr6SKC7G25CNxTyWKE5PF9XX6H/u9pSo="
-
base64-like blob (98 bytes, compression ratio 1.04) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "E5SlJDSTZleUp6SWpvaU9UQTNORE0zTXpFeE5Ua3pJbjE5TENKbGVIQnBjbUYwYVc5dUlqcDdJbk5sWTI5dVpITWlPakUyTm=="⟨U+000D⟩
}
-
base64-like blob (968 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
"WorkUnitToken": "1234eMAk4kLO4umqEL4Z5WuxL04AXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREEwYm9QbkhINmFYTWphbmMxZW1PQmEyMGlUb0JFbXNlWmRYc0NmckRIR1dmQ0hjY2YzNFdMcmNXb2JGZmhEK0QvZz09AAEAB2F3cy1rbXMAS2Fybjphd3M6a21zOnVzLWVhc3QtMTo3MDkxNTAyNDkyNDk6a2V5L2VmYmI3NDUyLTY1MjYtNGJiOS1iNmZhLTEzYzJkMTM3MmU2OQC4AQIBAHg6eWNF2Z
-
base64-like blob (96 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
}],⟨U+000D⟩
"NextToken": "E5SlJDSTZleUp6SWpvaU9UQTNORE0zTXpFeE5Ua3pJbjE5TENKbGVIQnBjbUYwYVc5dUlqcDdJbk5sWTI5dVpITWlPakUyTm"⟨U+000D⟩
}
-
base64-like blob (47 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "EJwY21GMGFXOXVJanA3SW5Ocm1pc3Npb25zIjpmYWxzZX0="⟨U+000D⟩
}
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "77X1ebypsI7os+X2lhHsZLGNCDK3nNGpwRdFpicSOHgcX1/QMoniUAKcpR3kj3ts3PVdMA=="⟨U+000D⟩
}
-
base64-like blob (40 bytes, compression ratio 1.27) (raw pass, confidence 0.60)
{⟨U+000D⟩
"NextToken": "c2VhcmNoQWxsVGFnc0luVGFibGVzIjpmYWxzZX0=",⟨U+000D⟩
"TableList": [{⟨U+000D⟩
"Table": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
},
"CodeSha256": "PFn4S+er27qk+UuZSTKEQfNKG/XNn7QJs90mJgq6oH8=",
"FunctionName": "my-function",
"CodeSize": 308,
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
},
"CodeSha256": "5tT2qgzYUHaqwR716pZ2dpkn/0J1FrzJmlKidWoaCgk=",
"Description": "",
"VpcConfig": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Version": "$LATEST",
"CodeSha256": "5tT2qgzYUHoqwR616pZ2dpkn/0J1FrzJmlKidWaaCgk=",
"FunctionName": "my-function",
"VpcConfig": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"CodeSize": 41784542,
"CodeSha256": "GGmv8ocUw4cly0T8HL0Vx/f5V4RmSCGNjDIslY4VskM=",
"Location": "https://awslambda-us-west-2-layers.s3.us-west-2.amazonaws.com/snapshots/123456789012/..."
},
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Location": "https://awslambda-us-east-2-layers.s3.us-east-2.amazonaws.com/snapshots/123456789012/my-layer-4aaa2fbb-ff77-4b0a-ad92-5b78a716a96a?versionId=27iWyA73cCAYqyH...",
"CodeSha256": "tv9jJO+rPbXUUXuRKi7CwHzKtLDkDRJLB3cC3Z/ouXo=",
"CodeSize": 169
},
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Version": "$LATEST",
"CodeSha256": "dBG9m8SGdmlEjw/JYXlhhvCrAv5TxvXsbL/RMr0fT/I=",
"FunctionName": "helloworld",
"MemorySize": 128,
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Version": "$LATEST",
"CodeSha256": "sU0cJ2/hOZevwV/lTxCuQqK3gDZP3i8gUoqUUVRmY6E=",
"FunctionName": "my-function",
"VpcConfig": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Version": "$LATEST",
"CodeSha256": "ZQukCqxtkqFgyF2cU41Avj99TKQ/hNihPtDtRcc08mI=",
"FunctionName": "my-python-function",
"VpcConfig": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Version": "$LATEST",
"CodeSha256": "sU0cJ2/hOZevwV/lTxCuQqK3gDZP3i8gUoqUUVRmY6E=",
"FunctionName": "my-function",
"VpcConfig": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Version": "1",
"CodeSha256": "5tT2qgzYUHoqwR616pZ2dpkn/0J1FrzJmlKidWaaCgk=",
"FunctionName": "my-function",
"VpcConfig": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Version": "2",
"CodeSha256": "sU0cJ2/hOZevwV/lTxCuQqK3gDZP3i8gUoqUUVRmY6E=",
"FunctionName": "my-function",
"VpcConfig": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"Location": "https://awslambda-us-west-2-layers.s3.us-west-2.amazonaws.com/snapshots/123456789012/my-layer-4aaa2fbb-ff77-4b0a-ad92-5b78a716a96a?versionId=27iWyA73cCAYqyH...",
"CodeSha256": "tv9jJO+rPbXUUXuRKi7CwHzKtLDkDRJLB3cC3Z/ouXo=",
"CodeSize": 169
},
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
},
"CodeSha256": "dBG9m8SGdmlEjw/JYXlhhvCrAv5TxvXsbL/RMr0fT/I=",
"FunctionName": "my-function",
"CodeSize": 294,
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
},
"CodeSha256": "5tT2qgzYUHaqwR716pZ2dpkn/0J1FrzJmlKidWoaCgk=",
"Description": "",
"VpcConfig": {
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
},
"CodeSha256": "5tT2qgzYUHaqwR716pZ2dpkn/0J1FrzJmlKidWoaCgk=",
"Description": "",
"VpcConfig": {
-
15 rows of base64-like lines, lines 23-24 (first: base64-like blob (372 bytes, compression ratio 0.84)) (raw pass, confidence 0.60)
"publicKeyBase64": "ssh-rsa ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCV0xUEwx96amPERH7K1bVT1tTFl9OmNk6o7m5YVHk9xlOdMbDRbFvhtXvw4jzJXXz5pBMxWOaGMz5K8QyTVOznoqp13Z8SBooH29hgmBNXiII1XPzEwqbj8mfo1+YVM5s5VuxWwm+BHUgedGUXno6uF7agqxZNO1kPLJBIVTW26SSYBJ0tE+y804UyVsjrbUqCaMXDhmfXpWulMPwuXhwcKh7e8hwoTfkiX0E6Ql+KqF/MiA3w6DCj
-
line length 2243 characters (raw pass, confidence 0.65)
"certKey": "ssh-rsa-cert-v01@openssh.com AEXAMPLEaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgNf076Dt3ppmPd0fPxZVMmS491aEAYYH9cHqAJ3fNML8AAAADAQABAAABAQD4APep5Ta2gHLk7m/vEXAMPLE2eBWJyQvn7ol/i0+s966h5sx8qUD79lPB7q5UESd5VZGFtytrykfQJnjiwqe7EV5agzvjblLj26Fb37EKda9HVfCOu8pWbvky7Tyn9w299a6CsG5o8HrkOymDE2c59lYxXGkilKo
-
26 rows of base64-like lines, lines 12-14 (first: base64-like blob (2188 bytes, compression ratio 0.71)) (raw pass, confidence 0.60)
"certKey": "ssh-rsa-cert-v01@openssh.com AEXAMPLEaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgNf076Dt3ppmPd0fPxZVMmS491aEAYYH9cHqAJ3fNML8AAAADAQABAAABAQD4APep5Ta2gHLk7m/vEXAMPLE2eBWJyQvn7ol/i0+s966h5sx8qUD79lPB7q5UESd5VZGFtytrykfQJnjiwqe7EV5agzvjblLj26Fb37EKda9HVfCOu8pWbvky7Tyn9w299a6CsG5o8HrkOymDE2c59lYxXGkilKo5I9
-
base64-like blob (372 bytes, compression ratio 0.81) (raw pass, confidence 0.60)
"publicKey": "AEXAMPLEaC1yc2EAAAADAQABAAABAQCoeR9ieZTjQ3pXCHczuAYZFjlF7t+uBkXuqeGMRex78pCvmS+DiEXAMPLEuJ1Q8dcKhrQL4HpXbD9dosVCTaJnJwb4MQqsuSVFdHFzy3guP+BKclWqtxJEXAMPLEsBGqZZlrIv6a9bTA0TCplZ8AD+hSRTaSXXqg6FT+Qf16IktH0XlMs7xIEXAMPLEmNtjCpzZiGXDHzytoMvUgwa8uHPp44Og36EUu4VqQxoUHPJKoXvcQizyk3K8ym0hP0TpD
-
base64-like blob (68 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
"algorithm": "ssh-ed25519",
"publicKey": "AEXAMPLEaC1lZDI1NTE5AAAAIC1gwGPDfGaONxEXAMPLEJX3UNap781QxHQmn8nzlrUv",
"witnessedAt": 1570744377.697,
"fingerprintSHA1": "SHA1:VEXAMPLE5ReqSmTgv03sSUw9toU",
-
base64-like blob (140 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
"algorithm": "ecdsa-sha2-nistp256",
"publicKey": "AEXAMPLEZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABEXAMPLE9B4mZy8YSsZW7cixCDq5yHSAAxjJkDo54C+EnKlDCsYtUkxxEXAMPLE6VOWL2z63RTKa2AUPgd8irjxWI=",
"witnessedAt": 1570744377.707,
-
base64-like blob (66 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"arn": "arn:aws:lightsail:us-west-2:111122223333:LoadBalancer/40486b2b-1ad0-4152-83e4-cEXAMPLE6f4b",
"supportCode": "6EXAMPLE3362/arn:aws:elasticloadbalancing:us-west-2:333322221111:loadbalancer/app/bEXAMPLE128cb59d86f946a9395dd304/1EXAMPLE8dd9d77e",
"createdAt": 1571677906.723,
-
base64-like blob (66 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"supportCode": "6EXAMPLE3362/arn:aws:elasticloadbalancing:us-west-2:333322221111:loadbalancer/app/bEXAMPLE128cb59d86f946a9395dd304/1EXAMPLE8dd9d77e",
"createdAt": 1571677906.723,
"location": {
-
base64-like blob (308 bytes, compression ratio 0.84) (raw pass, confidence 0.60)
"nextBackwardToken": "eEXAMPLEZXJUZXh0IjoiZnRWb3F3cUpRSlQ5NndMYThxelRUZlFhR3J6c2dKWEEvM2kvajZMZzVVVWpqRDN0YjFXTjNrak5pRk9iVFRZdjkwVGlpZGw5NFJGSFRQTEdJSjdpQnFCRk5CZFJlYTZaSXpScStuZjJEYXhqM2grUFVJOEpIYlU5YWJ2QitvQWN5cEFyVUo3VDk1QWY3bVF6MEwvcVovVldZdGc9Iiwibm9uY2UiOiJBNHpzdWMvUkZZKzRvUzhEIiwiY2lwaGVyIjoiQUVTL0dDTS
-
base64-like blob (308 bytes, compression ratio 0.84) (raw pass, confidence 0.60)
"nextForwardToken": "eEXAMPLEZXJUZXh0IjoiT09Lb0Z6ZFRJbHhaNEQ5N2tPbkkwRmwwNUxPZjFTbFFwUklQbzlSaWgvMWVXbEk4aG56VHg4bW1Gb3grbDVodUVNZEdiZXN0TzVYcjlLK1FUdFB2RlJLS2FMcU05WkN3Rm1uVzBkOFpDR2g0b1BBVlg2NVFGNDNPazZzRXJieHRuU0xzdkRNTkFUMTZibU9HM2YyaGxiS0hUUDA9Iiwibm9uY2UiOiJFQmI4STQ3cU5aWXNXZ0g4IiwiY2lwaGVyIjoiQUVTL0dDTS9
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
--upload-id 1122334455 \
--parts '[{"checksum":"gaCBQMe+rpCFZxLpoP6gydBoXaKKDA/Vobh5zBDb4W4=","partNumber":1,"partSource":"SOURCE1"}]'
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"creationTime": "2022-09-23T23:08:22.041227Z",
"digest": "nSCNo/qMWFxmplXpUdokXJnwgneOaxyyc2YOxVxrJTE=",
"id": "1234567",
"name": "my-wkflow-0",
-
line length 2277 characters (raw pass, confidence 0.65)
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV2VENDQXFXZ0F3SUJBZ0lSQU1ZZS8xMXFUK2svVzlRUDJQOElVdWd3RFFZSktvWklodmNOQVFFTkJRQXcKZ1lreEN6QUpCZ05WQkFZVEFsVlRNUmt3RndZRFZRUUtEQkJCVjFNZ1EzSjVjSFJ2WjNKaGNHaDVNU0V3SHdZRApWUVFMREJoQlYxTWdVR0Y1YldWdWRDQkRjbmx3ZEc5bmNtRndhSGt4RVRBUEJnTlZCQWdNQ0ZacGNtZHBibWxoCk1SVXdFd1lEVlFRRERB
-
base64-like blob (2272 bytes, compression ratio 0.72) (raw pass, confidence 0.60)
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV2VENDQXFXZ0F3SUJBZ0lSQU1ZZS8xMXFUK2svVzlRUDJQOElVdWd3RFFZSktvWklodmNOQVFFTkJRQXcKZ1lreEN6QUpCZ05WQkFZVEFsVlRNUmt3RndZRFZRUUtEQkJCVjFNZ1EzSjVjSFJ2WjNKaGNHaDVNU0V3SHdZRApWUVFMREJoQlYxTWdVR0Y1YldWdWRDQkRjbmx3ZEc5bmNtRndhSGt4RVRBUEJnTlZCQWdNQ0ZacGNtZHBibWxoCk1SVXdFd1lEVlFRRERB
-
line length 2921 characters (raw pass, confidence 0.65)
"KeyMaterial": "308205A106092A864886F70D010702A08205923082058E020101310D300B06096086480165030402013082031F06092A864886F70D010703A08203100482030C020100318201F4308201F002010030819F308189310B300906035504061302555331193017060355040A0C104157532043727970746F6772617068793121301F060355040B0C18415753205061796D656E74
-
line length 2277 characters (raw pass, confidence 0.65)
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV2RENDQXFTZ0F3SUJBZ0lRYWVCK25IbE1WZU1PR1ZiNjU1Q2JzREFOQmdrcWhraUc5dzBCQVEwRkFEQ0IKaVRFTE1Ba0dBMVVFQmhNQ1ZWTXhHVEFYQmdOVkJBb01FRUZYVXlCRGNubHdkRzluY21Gd2FIa3hJVEFmQmdOVgpCQXNNR0VGWFV5QlFZWGx0Wlc1MElFTnllWEIwYjJkeVlYQm9lVEVSTUE4R0ExVUVDQXdJVm1seVoybHVhV0V4CkZUQVRCZ05WQkFNTURE
-
base64-like blob (2272 bytes, compression ratio 0.72) (raw pass, confidence 0.60)
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV2RENDQXFTZ0F3SUJBZ0lRYWVCK25IbE1WZU1PR1ZiNjU1Q2JzREFOQmdrcWhraUc5dzBCQVEwRkFEQ0IKaVRFTE1Ba0dBMVVFQmhNQ1ZWTXhHVEFYQmdOVkJBb01FRUZYVXlCRGNubHdkRzluY21Gd2FIa3hJVEFmQmdOVgpCQXNNR0VGWFV5QlFZWGx0Wlc1MElFTnllWEIwYjJkeVlYQm9lVEVSTUE4R0ExVUVDQXdJVm1seVoybHVhV0V4CkZUQVRCZ05WQkFNTURE
-
line length 2877 characters (raw pass, confidence 0.65)
3082059806092A864886F70D010702A082058930820585020101310D300B06096086480165030402013082031606092A864886F70D010703A082030704820303020100318201F3308201EF02010030819E308189310B300906035504061302555331193017060355040A0C104157532043727970746F6772617068793121301F060355040B0C18415753205061796D656E742043727970746F6772617068
-
base64-like blob (151 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJDcmVhdGlvbkRhdGUiOiIyMDE5LTA3LTE2VDE0OjM4OjUzLjkwM1oiLCJBY2NvdW50SWQiOiI1MTIzOTcxODM4NzciLCJBcHBJZCI6Ijk1ZTM2MGRiMzBkMjQ1ZjRiYTYwYjhlMzllMzZlNjZhIn0"⟨U+000D⟩
}⟨U+000D⟩
}
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
{
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAyfQ==",
"AttributeValues": [
{
-
base64-like blob (192 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
"FormatVersion": "aws_v1",
"NextToken": "WGDY7ko8fQXdlaUZVdasFQ==:RVSagyIFn770XQOzdUIcO9BY6ucBG9itXAZGZF/zioUzOsUKh6PCcPWaOyPZRiMePb986TeoKYB9l55fw/CyoMq5ymnGmT1Vj39TljbbAlhcqnVfTmPIilx8Uy5bdDaBYy/e/2Ofw9Edzsykbs8LTBuNbiDQ+BBds5yeI9AQkUepruKk3aEahFPxJ55kx/zk",
"PriceList": [
-
base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJNYXJrZXIiOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAyfQ=="⟨U+000D⟩
}
-
base64-like blob (74 bytes, compression ratio 1.01) (raw pass, confidence 0.60)
&X-Amz-Expires=900&X-Amz-SignedHeaders=host&X-Amz-Signature=5a8753ebEXAMPLEa2c724e5667797EXAMPLE9d6ec6e3f427191fa41aeEXAMPLE
-
base64-like blob (73 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
"DbUser": "IAM:adminuser",⟨U+000D⟩
"DbPassword": "AMAFUyyuros/QjxPTtgzcsuQsqzIasdzJEN04aCtWDzXx1O9d6UmpkBtvEeqFly/EXAMPLE==",⟨U+000D⟩
"Expiration": "2019-12-10T17:25:05.770Z"⟨U+000D⟩
}
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
{
"NextToken": "3D01ClxlCiT31VsRDkAO3IybLb/h5AtDWSGuhYi+N1FIJwwPtAkuKzDhL2rV3GcwmNt77+12",
"Celebrities": [
{
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
{
"NextToken": "dlhcKMHMzpCBGFukz6IO3JMcWiJAamCVhXHt3r6b4b5Tfbyw3q7o+Jeezt+ZpgfOnW9FCCgQ",
"ModerationLabels": [
{
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
],
"NextToken": "OzL223pDKy9116O/02KXRqFIEAwxjy4PkgYcm3hSo0rdysbXg5Ex0eFgTGEj0ADEac6S037U",
"JobStatus": "SUCCEEDED",
"VideoMetadata": {
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
],
"NextToken": "5bkgcezyuaqhtWk3C8OTW6cjRghrwV9XDMivm5B3MXm+Lv6G+L+GejyFHPhoNa/ldXIC4c/d",
"JobStatus": "SUCCEEDED",
"VideoMetadata": {
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
},
"NextToken": "BMugzAi4L72IERzQdbpyMQuEFBsjlo5W0Yx3mfG+sR9mm98E1/CpObenspRfs/5FBQFs4X7G"
}
-
base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
],
"NextToken": "D/vRIYNyhG79ugdta3f+8cRg9oSRo+HigGOuxRiYpTn0ExnqTi1CJektVAc4HrAXDv25eHYk",
"JobStatus": "SUCCEEDED",
"VideoMetadata": {
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAxMH0="
}
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
--max-items 10 \
--starting-token eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAxMH0=
Output::
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAyMH0="
}
-
base64-like blob (68 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=EXAMPLE1234494d5fba3fed607f98018e1dfc62e2529ae96d844123456
-
base64-like blob (68 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=EXAMPLE1234494d5fba3fed607f98018e1dfc62e2529ae96d844123456
-
base64-like blob (152 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
{⟨U+000D⟩
"NextToken": "U2FsdGVkX18vvPlOqb7RDrWRWVFBJI46MOIAb+nZmRJmR15NoRi2gm13sdQEn3O/pq/78dGs+bKpgA+7HMPHO0qX33/zoRI+uIG/F9yLNhcOrOWzFUdy36JcXLQji3Rpnn/cD1SVkGA98qI3zPOSDg==",⟨U+000D⟩
"Products": [ ⟨U+000D⟩
{
-
base64-like blob (256 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "U2FsdGVkX1+eNkPoZHVl11ip5HUYQPWSWZGmftcmJiHL8JoKEsCDuaKayiPDyLK+LiTkShveoOdvfxXCkOBaGhohIXhsIedN+LSjQV/l7kfCfJcq4PziNC1N9xe9aq2pjlLVZnznTfSImrodT5bRNHe4fELCQq/z+5ka+5Lzmc11axcwTd5lKgQyQqmUVoeriHZhyIiBgWKf7oNYdBVG8OEortVWvSkoUTt+B2ThcnC7l43kI0UNxlkZ6sc64AsW"⟨U+000D⟩
}
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAxfQ=="⟨U+000D⟩
}
-
base64-like blob (152 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "U2FsdGVkX1/UprCPzxVbkDeHikDXbDxfgJZ1w2RG1XWsFPTMTIQPVE0m/FduIGxS7ObRtAbaUt/8/RCQcg2PU0YXI20hH/GrhoOTgv+TSm0qvQVFhkJepWmqh+NYawjocVBeos6xzn/8qnbF9IuwGg=="⟨U+000D⟩
}
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAzfQ=="⟨U+000D⟩
}
-
base64-like blob (64 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
"DocumentDescription": {
"Hash": "fc2410281f40779e694a8b95975d0f9f316da8a153daa94e3d9921102EXAMPLE",
"HashType": "Sha256",
"Name": "Example",
-
base64-like blob (64 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
"Document": {
"Hash": "fc2410281f40779e694a8b95975d0f9f316da8a153daa94e3d9921102EXAMPLE",
"HashType": "Sha256",
"Name": "Example",
-
base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
%2F20190215%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=efaaaf6e3878e77f48a6697e015efdbda9c426b09c5822055075c062f6ad2149"⟨U+000D⟩
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAyfQ=="
}
-
string literal compression ratio 0.969 (129 bytes) (raw pass, confidence 0.60)
aws ssm put-inventory --instance-id "i-016648b75dd622dab" --items "TypeName=Custom:RackInfo,SchemaVersion=1.0,CaptureTime=2019-01-22T10:01:01Z,Content=[{RackLocation='Bay B/Row C/Rack D/Shelf F'}]"
-
base64-like blob (400 bytes, compression ratio 0.84) (raw pass, confidence 0.60)
"TokenValue": "AAEAAVbTGsaOnyvcUoNGqifbv5r/8lgxuQljCuY8qVcvOnoBAAAAAFxtd3jIXAFUUXGTJ7zF/AWJPwDviOlF5p3dlAgrqVIVO6IEXhkHLz0/1gXKRKEME71E6TLOplLDJAMZ+kREejkZu4c5AxMkrQjMF+gtHP1bYJKTwtHQd1wjulPLexO8SHl7g5R/wekrj6WsDUpnEegFBfGftpAIz2GXQVfTJXKfkc5qepQ11C11DOIT2dozOqXgHwfQHfAKLErM5dWDZqKwyT1Z3iw7unQdm3p5qsbrugiOZ7CRA
-
base64-like blob (336 bytes, compression ratio 0.83) (raw pass, confidence 0.60)
"SessionToken": "IQoJb3JpZ2luX2VjEOz////////////////////wEXAMPLEtMSJHMEUCIDoKK3JH9uGQE1z0sINr5M4jk+Na8KHDcCYRVjJCZEvOAiEA3OvJGtw1EcViOleS2vhs8VdCKFJQWPQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8f
-
base64-like blob (93 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
--web-identity-token "Atza%7CIQEBLjAsAhRFiXuWpUXuRvQ9PZL3GMFcYevydwIUFAHZwXZXXXXXXXXJnrulxKDHwy87oGKPznh0D6bEQZTSCzyoCtL_8S07pLpr0zMbn6w1lfVZKNTBdDansFBmtGnIsIapjI6xKR02Yc_2bQ8LZbUXSGm6Ry6_BG7PrtLZtj_dfCTj92xNGed-CrKqjG7nPBjNIL016GGvuS5gSvPRUxWES3VYfm1wl7WTI7jn-Pcb6M-buCgHhFOzTQxod27L9CqnOLio7N3gZAGpsp6n1-AJBOC
-
base64-like blob (239 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
"SessionToken": "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE",
-
base64-like blob (415 bytes, compression ratio 0.83) (raw pass, confidence 0.60)
"SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf
-
base64-like blob (415 bytes, compression ratio 0.83) (raw pass, confidence 0.60)
"SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf
-
5 rows of base64-like lines, lines 6-6 (first: base64-like blob (107 bytes, compression ratio 1.10)) (raw pass, confidence 0.60)
Ojau7BMjOTWwOtHPhV_Zaz87yENdipr745EjQwRd5LaoL3vN8_5ZfA9UiBMKDgVh1gjqZJFUiQoubv78V1RbHNYnK44ElGKmUWYa020I1y6TNS9LXoNmc62GzkfGvoPGhD13br5tXEOo1rAm3vsPewRDFNkYL-4_1MWWezhRNEpqvXBDXLI9xEux7YYkRtjd45NJLFzZynBUubV8NHOevVuighd1Mvz3OiA-1_oPSe4TBtjfN9s7kjU1z70WpVbUgrLVp1xXTK1rf9Ea7t8shPd-3VzKhjS5tLrweFxNOKwV2GtT76B_fRp8HTYz-pOu
-
line length 2158 characters (raw pass, confidence 0.65)
"DecodedMessage": "{\"allowed\":false,\"explicitDeny\":true,\"matchedStatements\":{\"items\":[{\"statementId\":\"VisualEditor0\",\"effect\":\"DENY\",\"principals\":{\"items\":[{\"value\":\"AROA123456789EXAMPLE\"}]},\"principalGroups\":{\"items\":[]},\"actions\":{\"items\":[{\"value\":\"ec2:RunInstances\"}]},\"r
-
base64-like blob (250 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
"SessionToken": "EXAMPLEpZ2luX2VjEGoaCXVzLXdlc3QtMiJIMEYCIQC/W9pL5ArQyDD5JwFL3/h5+WGopQ24GEXweNctwhi9sgIhAMkg+MZE35iWM8s4r5Lr25f9rSTVPFH98G42QQunWMTfKq0DCOP//////////wEQAxoMNDUyOTI1MTcwNTA3Igxuy3AOpuuoLsk3MJwqgQPg8QOd9HuoClUxq26wnc/nm+eZLjHDyGf2KUAHK2DuaS/nrGSEXAMPLE",
-
base64-like blob (239 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
"SessionToken": "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE",
-
base64-like blob (73 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
aws support describe-attachment \⟨U+000D⟩
--attachment-id "attachment-KBnjRNrePd9D6Jx0-Mm00xZuDEaL2JAj_0-gJv9qqDooTipsz3V1Nb19rCfkZneeQeDPgp8X1iVJyHH7UuhZDdNeqGoduZsPrAhyMakqlc60-iJjL5HqyYGiT1FG8EXAMPLE"⟨U+000D⟩
⟨U+000D⟩
Output::
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJuZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQEXAMPLE=="⟨U+000D⟩
}
-
base64-like blob (256 bytes, compression ratio 0.88) (raw pass, confidence 0.60)
{
"nextPageToken": "AAAAKgAAAAEAAAAAAAAAA1Gp1BelJq+PmHvAnDxJYbup8+0R4LVtbXLDl7QNY7C3OpHo9Sz06D/GuFz1OyC73umBQ1tOPJ/gC/aYpzDMqUIWIA1T9W0s2DryyZX4OC/6Lhk9/o5kdsuWMSBkHhgaZjgwp3WJINIFJFdaSMxY2vYAX7AtRtpcqJuBDDRE9RaRqDGYqIYUMltarkiqpSY1ZVveBasBvlvyUb/WGAaqehiDz7/JzLT/wWNNUMOd+Nhe",
"typeInfos": [
-
base64-like blob (256 bytes, compression ratio 0.88) (raw pass, confidence 0.60)
--maximum-page-size 2 \
--next-page-token "AAAAKgAAAAEAAAAAAAAAA1Gp1BelJq+PmHvAnDxJYbup8+0R4LVtbXLDl7QNY7C3OpHo9Sz06D/GuFz1OyC73umBQ1tOPJ/gC/aYpzDMqUIWIA1T9W0s2DryyZX4OC/6Lhk9/o5kdsuWMSBkHhgaZjgwp3WJINIFJFdaSMxY2vYAX7AtRtpcqJuBDDRE9RaRqDGYqIYUMltarkiqpSY1ZVveBasBvlvyUb/WGAaqehiDz7/JzLT/wWNNUMOd+Nhe"
-
base64-like blob (256 bytes, compression ratio 0.88) (raw pass, confidence 0.60)
{
"nextPageToken": "AAAAKgAAAAEAAAAAAAAAAw+7LZ4GRZPzTqBHsp2wBxWB8m1sgLCclgCuq3J+h/m3+vOfFqtkcjLwV5cc4OjNAzTCuq/XcylPumGwkjbajtqpZpbqOcVNfjFxGoi0LB2Olbvv0krbUISBvlpFPmSWpDSZJsxg5UxCcweteSlFn1PNSZ/MoinBZo8OTkjMuzcsTuKOzH9wCaR8ITcALJ3SaqHU3pyIRS5hPmFA3OLIc8zaAepjlaujo6hntNSCruB4"
"typeInfos": [
-
base64-like blob (256 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
{
"nextPageToken": "AAAAKgAAAAEAAAAAAAAAAwXcpu5ePSyQkrC+8WMbmSrenuZC2ZkIXQYBPB/b9xIOVkj+bMEFhGj0KmmJ4rF7iddhjf7UMYCsfGkEn7mk+yMCgVc1JxDWmB0EH46bhcmcLmYNQihMDmUWocpr7To6/R7CLu0St1gkFayxOidJXErQW0zdNfQaIWAnF/cwioBbXlkz1fQzmDeU3M5oYGMPQIrUqkPq7pMEW0q0lK5eDN97NzFYdZZ/rlcLDWPZhUjY",
"typeInfos": [
-
base64-like blob (216 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
],
"nextPageToken": "AAAAKgAAAAEAAAAAAAAAA2QJKNtidVgd49TTeNwYcpD+QKT2ynuEbibcQWe2QKrslMGe63gpS0MgZGpcpoKttL4OCXRFn98Xif557it+wSZUsvUDtImjDLvguyuyyFdIZtvIxIKEOPm3k2r4OjAGaFsGOuVbrKljvla7wdU7FYH3OlkNCP8b7PBj9SBkUyGoiAghET74P93AuVIIkdKGtQ=="
}
-
base64-like blob (216 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
--maximum-page-size 1 \
--next-page-token "AAAAKgAAAAEAAAAAAAAAA2QJKNtidVgd49TTeNwYcpD+QKT2ynuEbibcQWe2QKrslMGe63gpS0MgZGpcpoKttL4OCXRFn98Xif557it+wSZUsvUDtImjDLvguyuyyFdIZtvIxIKEOPm3k2r4OjAGaFsGOuVbrKljvla7wdU7FYH3OlkNCP8b7PBj9SBkUyGoiAghET74P93AuVIIkdKGtQ=="
Output::
-
base64-like blob (112 bytes, compression ratio 1.04) (raw pass, confidence 0.60)
], ⟨U+000D⟩
"NextToken": "cY1W3eTFvoB0cH7YrKVudI4Gb0H8J0xAYLo8xI/JunCIPWCthaKQ+07n/ElyutsSy0+1VOImoTRmP1zw4P0RFtaeV9Bzhnfedpx1YqwB4xaGDA==", ⟨U+000D⟩
"DocumentMetadata": {⟨U+000D⟩
"Pages": 1
-
base64-like blob (112 bytes, compression ratio 1.10) (raw pass, confidence 0.60)
], ⟨U+000D⟩
"NextToken": "GcqyoAJuZwujOT35EN4LCI3EUzMtiLq3nKyFFHvU5q1SaIdEBcSty+njNgoWwuMP/muqc96S4o5NzDqehhXvhkodMyVO5OJGyms5lsrCxibWJw==", ⟨U+000D⟩
"DocumentMetadata": {⟨U+000D⟩
"Pages": 1
-
base64-like blob (986 bytes, compression ratio 0.79) (raw pass, confidence 0.60)
"NextToken": "3/PblzkiGhzjER3KHuQt2fmbPLF7cDYafjFMEoGn44ON/gsuUSTIkGyanvRE6WMXFd/ZTEc2EZj+P9eii/z1O2FDYli6RLI0WoRX4RwMisVrh9G0Kie0Y8ikBCdtqlZB10Wa9McC+ebOl+LaDtZPC4u6ttoHLRlEfzqstHXSgapXg3tEBtm9piIaPB6MOM5BB6t86+qtmocTR/qrteHZBBudhTfbCwhsxaqujHiiUvFdm3BQbKKWIW06yV9b+4f38oD2lVIan+vfUs3gBYAl5VTDmXXzQPBQOHPjtwmFI+
-
base64-like blob (104 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
],⟨U+000D⟩
"Marker": "DnF1ZXJ5VGhlbkZldGNoAgAAAAAAAAS7FmlTaU1OdlFTU1h1UU00VVFIbDlRWHcAAAAAAAAJTRY3bWh5eUgzaVF1ZXN2RUE5Wm8tTTdR"⟨U+000D⟩
}
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
%2F20180816%2Fus-west-2%2Fs3%2Faws1_request&X-Amz-Signature=01Ab2c34d567e8f90123g456hi78j901k2345678l901234mno56pqr78EXAMPLE"⟨U+000D⟩
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
%2F20180816%2Fus-west-2%2Fs3%2Faws1_request&X-Amz-Signature=01Ab2c34d567e8f90123g456hi78j901k2345678l901234mno56pqr78EXAMPLE"⟨U+000D⟩
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
%2F20180820%2Fus-west-2%2Fs3%2Faws1_request&X-Amz-Signature=01Ab2c34d567e8f90123g456hi78j901k2345678l901234mno56pqr78EXAMPLE"⟨U+000D⟩
-
base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
%2F20180912%2Fus-west-2%2Fs3%2Faws1_request&X-Amz-Signature=01Ab2c34d567e8f90123g456hi78j901k2345678l901234mno56pqr78EXAMPLE",
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
__import__(name)
return sys.modules[name]
likely benign
LLM, confidence 0.95
Vendored six library helper that imports a module by name.
Reasoning
This is the standard six.py import helper, a vendored copy of a widely used library. The __import__ call on a dynamic module name is its documented purpose, and the function only returns sys.modules[name]. Nothing here fetches or runs external content.
-
`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
if _globs_ is None:
frame = sys._getframe(1)
_globs_ = frame.f_globals
if _locs_ is None:
likely benign
LLM, confidence 0.95
Vendored six compatibility shim reads the caller's frame globals for exec.
Reasoning
sys._getframe(1) is used in six's exec_ compatibility shim to read the caller's globals and locals when none are passed. This is a known, benign pattern in the vendored library. The 'anti-analysis' label is a heuristic match on nearby exec use, not evidence of evasion.
-
file imports decoder module(s) base64, binascii, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
try:
digest = zlib.decompress(
result['Body'].read(), zlib.MAX_WBITS | 16
)
likely benign
LLM, confidence 0.90
Decompresses a CloudTrail digest file downloaded from S3 for validation.
Reasoning
The code fetches a CloudTrail digest object from S3 and decompresses it with zlib using gzip-wrapper window bits. This is the normal way AWS CLI validates log digests. The data comes from the service and is not an embedded hidden payload.
-
`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
subprocess.check_call(
[
r'.\{0}'.format(self.INSTALLER),
likely benign
LLM, confidence 0.70
Runs the bundled CodeDeploy agent installer via subprocess with shell enabled.
Reasoning
The call runs a fixed CodeDeploy agent installer, built from a class constant and formatted with the installer name. The shell=True flag is poor practice and the argument list is unusual, but the command is a literal local installer rather than attacker-controlled input or a download-and-execute chain. Some doubt remains about the shell flag.
-
4 rows of base64-like lines, lines 13-22 (first: base64-like blob (128 bytes over 2 lines, compression ratio 0.98)) (raw pass, confidence 0.60)
-----BEGIN CERTIFICATE-----
MIIEDzCCAvegAwIBAgIRAJuJ8f6ZVYL7gG/rS3qvrZMwDQYJKoZIhvcNAQELBQAw
cTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1Nl
....certificate body truncated for brevity....
likely benign
LLM, confidence 0.95
Doc example showing a PEM certificate in base64 form.
Reasoning
This is a documentation example showing a truncated PEM certificate body, marked as abbreviated. Base64 certificate text is expected in AWS CLI examples. It is not executed or hidden from readers.
-
base64-like blob (80 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
--configuration-profile-id "ur8hx2f" \
--content eyAiTmFtZSI6ICJFeGFtcGxlQXBwbGljYXRpb24iLCAiSWQiOiBFeGFtcGxlSUQsICJSYW5rIjogNyB9 \
--content-type "application/json" \
configuration_version_output_file
likely benign
LLM, confidence 0.95
Doc example with base64-encoded JSON configuration content.
Reasoning
The blob decodes to a small JSON document in a CLI example for a hosted configuration. Documentation examples routinely show encoded content like this. No execution is involved.
-
base64-like blob (172 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
{⟨U+000D⟩
"NextToken": "eyJDdXN0b21lckFjY291bnRJZCI6IjI3MDIwNTQwMjg0NSIsIlNlcnZpY2VTdGF0dXNDb2RlIjoiUFJPVklTSU9OSU5HIiwiSGFzaEtleSI6IjI3MDIwNTQwMjg0NSNhYjhmOTRjZmUyOWE0NjBmYjg3NjBhZmQyZWU4NzU1NSJ9",⟨U+000D⟩
"ServiceSummaryList": [⟨U+000D⟩
{
likely benign
LLM, confidence 0.95
Doc example showing a base64 pagination token in sample output.
Reasoning
The value is a base64-encoded JSON pagination NextToken, which is standard AWS API behavior. It appears in a sample output block in documentation.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAxMH0="⟨U+000D⟩
}
likely benign
LLM, confidence 0.95
Doc example showing a base64 pagination token.
Reasoning
This is a base64-encoded JSON NextToken in sample pagination output, a normal AWS API artifact that decodes to harmless fields.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAyfQ=="⟨U+000D⟩
}
likely benign
LLM, confidence 0.95
Doc example showing a base64 pagination token.
Reasoning
This is the same base64 JSON NextToken pagination artifact seen in other Athena examples, in sample output.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJOZXh0VG9XMPLiOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAyfQ=="⟨U+000D⟩
}
likely benign
LLM, confidence 0.93
Doc example showing a placeholder base64 pagination token.
Reasoning
This is a base64 pagination token in sample output. The 'XMPL' placeholder fragment indicates an AWS documentation example value, not real data.
-
base64-like blob (76 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
est ID: F7F21CXMPL580224; S3 Extended Request ID: egd/Fdt89BXMPLyiqbMNljVk55Yqqvi3NYW2nKLUVWhUGEhNfCmZdyj967lhriaG/dWMobSO40o=)."⟨U+000D⟩
likely benign
LLM, confidence 0.95
Doc example with an S3 request ID containing placeholder text.
Reasoning
The blob is part of an S3 Extended Request ID inside an error message in documentation. The 'EXAMPLE' and 'XMPL' markers show placeholder values. This is not an encoded payload.
-
base64-like blob (64 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
"Id": "E74FTE3AEXAMPLE",
"S3CanonicalUserId": "cd13868f797c227fbea2830611a26fe0a21ba1b826ab4bed9b7771c9aEXAMPLE",
"CloudFrontOriginAccessIdentityConfig": {
"CallerReference": "cli-example",
likely benign
LLM, confidence 0.95
Doc example with a placeholder S3 canonical user ID.
Reasoning
The value is an S3 canonical user ID in sample output, marked with the EXAMPLE placeholder suffix. It is an identifier, not an encoded payload.
-
6 rows of base64-like lines, lines 23-23 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"EncodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxPMbCA2Ks0lnd7IR+3pw\nwd3H/7jPGwj8bLUmore7bX+oeGpZ6QmLAe/1UOWcmZX2u70dYcSIzB1ofZtcn4cJ\nenHBAzO3ohBY/L1tQGJfS2A+omnN6H16VZE1JCK8XSJyfze7MDLcUyHZETdxuvRb\nA9X343/vMAuQPnhinFJ8Wdy8YBXSPpy7r95ylUQd9LfYTBzVZYG2tSesplcOkjM3\n2Uu+o
likely benign
LLM, confidence 0.95
Doc example embedding a PEM public key in base64 form.
Reasoning
These lines are a PEM public key in a sample JSON argument for CloudFront. Public key material in examples is normal and nothing decodes or runs it.
-
6 rows of base64-like lines, lines 38-38 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"EncodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxPMbCA2Ks0lnd7IR+3pw\nwd3H/7jPGwj8bLUmore7bX+oeGpZ6QmLAe/1UOWcmZX2u70dYcSIzB1ofZtcn4cJ\nenHBAzO3ohBY/L1tQGJfS2A+omnN6H16VZE1JCK8XSJyfze7MDLcUyHZETdxuvRb\nA9X343/vMAuQPnhinFJ8Wdy8YBXSPpy7r95ylUQd9LfYTBzVZYG2tSesplcOkjM3\n2Uu+o
likely benign
LLM, confidence 0.97
Documentation example of a PEM-encoded public key in a CloudFront CLI request.
Reasoning
This is an AWS CLI documentation example showing a placeholder PEM public key in JSON. Base64 content in a public key is expected; raw pass has high false-positive rate.
-
base64-like blob (64 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
"Id": "E74FTE3AEXAMPLE",
"S3CanonicalUserId": "cd13868f797c227fbea2830611a26fe0a21ba1b826ab4bed9b7771c9aEXAMPLE",
"CloudFrontOriginAccessIdentityConfig": {
"CallerReference": "cli-example",
likely benign
LLM, confidence 0.97
Documentation sample of an origin access identity canonical user ID.
Reasoning
S3CanonicalUserId values with EXAMPLE suffix are placeholder identifiers in AWS docs; not malicious encoding.
-
6 rows of base64-like lines, lines 19-19 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"EncodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxPMbCA2Ks0lnd7IR+3pw\nwd3H/7jPGwj8bLUmore7bX+oeGpZ6QmLAe/1UOWcmZX2u70dYcSIzB1ofZtcn4cJ\nenHBAzO3ohBY/L1tQGJfS2A+omnN6H16VZE1JCK8XSJyfze7MDLcUyHZETdxuvRb\nA9X343/vMAuQPnhinFJ8Wdy8YBXSPpy7r95ylUQd9LfYTBzVZYG2tSesplcOkjM3\n2Uu+o
likely benign
LLM, confidence 0.97
Documentation example of a public key config with a PEM key.
Reasoning
Same placeholder PEM public key in AWS CLI documentation output.
-
6 rows of base64-like lines, lines 22-22 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"EncodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxPMbCA2Ks0lnd7IR+3pw\nwd3H/7jPGwj8bLUmore7bX+oeGpZ6QmLAe/1UOWcmZX2u70dYcSIzB1ofZtcn4cJ\nenHBAzO3ohBY/L1tQGJfS2A+omnN6H16VZE1JCK8XSJyfze7MDLcUyHZETdxuvRb\nA9X343/vMAuQPnhinFJ8Wdy8YBXSPpy7r95ylUQd9LfYTBzVZYG2tSesplcOkjM3\n2Uu+o
likely benign
LLM, confidence 0.97
Documentation example of a public key response with a PEM key.
Reasoning
Same placeholder PEM public key in AWS CLI documentation output; no execution or exfiltration.
-
base64-like blob (64 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
"Id": "E74FTE3AEXAMPLE",
"S3CanonicalUserId": "cd13868f797c227fbea2830611a26fe0a21ba1b826ab4bed9b7771c9aEXAMPLE",
"Comment": "Example OAI"
},
likely benign
LLM, confidence 0.97
Documentation sample listing origin access identities.
Reasoning
Canonical user ID placeholder with EXAMPLE suffix in documentation listing output.
-
base64-like blob (70 bytes, compression ratio 0.94) (raw pass, confidence 0.60)
"Id": "EH1HDMBEXAMPLE",
"S3CanonicalUserId": "1489f6f2e6faacaae7ff64c4c3e6956c24f78788abfc1718c3527c263bf7a17EXAMPLE",
"Comment": "Test OAI"
},
likely benign
LLM, confidence 0.97
Documentation sample listing origin access identities.
Reasoning
Placeholder canonical user ID with EXAMPLE suffix in documentation.
-
base64-like blob (70 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
"Id": "E2X2C9TEXAMPLE",
"S3CanonicalUserId": "cbfeebb915a64749f9be546a45b3fcfd3a31c779673c13c4dd460911ae402c2EXAMPLE",
"Comment": "Example OAI #2"
}
likely benign
LLM, confidence 0.97
Documentation sample listing origin access identities.
Reasoning
Placeholder canonical user ID with EXAMPLE suffix in documentation.
-
base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJNYXJrZXIiOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAzfQ=="⟨U+000D⟩
}
likely benign
LLM, confidence 0.96
Documentation sample of a base64-encoded pagination NextToken.
Reasoning
The value is a base64-encoded pagination token decoding to a JSON marker object, a normal AWS NextToken in docs.
-
6 rows of base64-like lines, lines 19-19 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"EncodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxPMbCA2Ks0lnd7IR+3pw\nwd3H/7jPGwj8bLUmore7bX+oeGpZ6QmLAe/1UOWcmZX2u70dYcSIzB1ofZtcn4cJ\nenHBAzO3ohBY/L1tQGJfS2A+omnN6H16VZE1JCK8XSJyfze7MDLcUyHZETdxuvRb\nA9X343/vMAuQPnhinFJ8Wdy8YBXSPpy7r95ylUQd9LfYTBzVZYG2tSesplcOkjM3\n2Uu+o
likely benign
LLM, confidence 0.97
Documentation example listing public keys with a PEM key.
Reasoning
Placeholder PEM public key in AWS CLI documentation output.
-
6 rows of base64-like lines, lines 26-26 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
"EncodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApOCAg88A8+f4dujn9Izt\n26LxtgAkn2opGgo/NKpMiaisyw5qlg3f1gol7FV6pYNl78iJg3EO8JBbwtlH+cR9\nLGSf60NDeVhm76Oc39Np/vWgOdsGQcRbi9WmKZeSODqjQGzVZWqPmito3FzWVk6b\nfVY5N36U/RdbVAJm95Km+qaMYlbIdF40t72bi3IkKYV5hlB2XoDjlQ9F6ajQKyTB\nMHa3S
likely benign
LLM, confidence 0.97
Documentation example listing public keys with a second PEM key.
Reasoning
Placeholder PEM public key in AWS CLI documentation output.
-
base64-like blob (88 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
Wr8AuUYikzGdJ4-qzx6WnxXfH~fxg4-GGl6l2kgCpXUB6Jx6K~Y3kpVOdzUPOIqFLHAnJojbhxqrVejomZZ2XrquDvNUCCIbePGnR3d24UPaLXG4FKOqNEaWDIBXu7jUUPwOyQCvpt-GNvjRJxqWf93uMobeMOiVYahb-e0KItiQewGcm0eLZQ__&Key-Pair-Id=APKAEIBAERJR2EXAMPLE
likely benign
LLM, confidence 0.96
Documentation example of a CloudFront signed URL signature.
Reasoning
A CloudFront signed URL signature in documentation with placeholder Key-Pair-Id EXAMPLE; expected format for signed URLs.
-
base64-like blob (64 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
"Id": "E74FTE3AEXAMPLE",
"S3CanonicalUserId": "cd13868f797c227fbea2830611a26fe0a21ba1b826ab4bed9b7771c9aEXAMPLE",
"CloudFrontOriginAccessIdentityConfig": {
"CallerReference": "cli-example",
likely benign
LLM, confidence 0.95
Sample S3 canonical user ID in an AWS CLI CloudFront documentation example.
Reasoning
The flagged value is the S3CanonicalUserId in a CloudFront origin access identity JSON example. It is a documented-style placeholder ending in EXAMPLE, in an AWS CLI reference doc. Raw-pass base64 matches on identifiers like this are false positives.
-
base64-like blob (360 bytes, compression ratio 0.83) (raw pass, confidence 0.60)
"Value": "MIIBCgKCAQEAlSS3cl92HDycr/MTj0moOhas8habjrraXw+KzlWF0axSI2tcF+3iJ9BKQAVSKxGwxwu3m0wG3J+kUl1xboEcEPHYoIYMbgfSw7KGnuDKwkLzsQWhUJ0cIbOHASox1vv/5fNXkrHhGbDCHeVXm804c83nvHUEFYThr1PfyP/8HwrCtR3FX5OANtQCP61C1nJtSSkC8JSQUOrIP4CuwJjc+4WGDk+BGH5m9iuiAKkipEHWmUl8/P7XpfpWQuk4h8g3pXZOrNXr08lbh4d39svj7UqdhvOXoBI
likely benign
LLM, confidence 0.93
Sample RSA public key shown in CloudTrail list-public-keys documentation output.
Reasoning
The 360-byte blob is an RSA public key (the DER-encoded SubjectPublicKeyInfo, with the PEM-style base64 prefix) shown as sample output in CloudTrail CLI docs. Public keys carry no secret and this is documentation output.
-
line length 1160 characters (raw pass, confidence 0.50)
"CloudTrailEvent": "{\"eventVersion\":\"1.02\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AROAJIKPFTA72SWU4L7T4:my-session-name\",\"arn\":\"arn:aws:sts::123456789012:assumed-role/my-role/my-session-name\",\"accountId\":\"123456789012\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\
-
line length 1135 characters (raw pass, confidence 0.50)
--advanced-event-selectors '[{"Name": "Log all management events", "FieldSelectors": [{ "Field": "eventCategory", "Equals": ["Management"] }] },{"Name": "Log PutObject and DeleteObject events for all but one bucket","FieldSelectors": [{ "Field": "eventCategory", "Equals": ["Data"] },{ "Field": "resources.type",
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"4.0.0": {
"revision": "Ciqe5/9yicvkJT13b5/LdLpCyE6fqA7poa9qp+FilPs=",
"status": "Deleted"
}
likely benign
LLM, confidence 0.95
Placeholder package version revision string in a CodeArtifact delete example.
Reasoning
The value is a package version revision token, an opaque placeholder string in a CodeArtifact CLI doc example. A 44-byte base64 string with a trailing '=' matches a random-looking ID, and this pattern is unremarkable in docs.
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"4.0.0": {
"revision": "Ciqe5/9yicvkJT13b5/LdLpCyE6fqA7poa9qp+FilPs=",
"status": "Disposed"
}
likely benign
LLM, confidence 0.95
Placeholder package version revision string in a CodeArtifact dispose example.
Reasoning
Same placeholder revision string as other CodeArtifact doc examples, used in a dispose-status JSON output sample. No executable or malicious context.
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"packageVersion": "4.0.0",
"packageVersionRevision": "Ciqe5/9yicvkJT13b5/LdLpCyE6fqA7poa9qp+FilPs="
}
likely benign
LLM, confidence 0.95
Placeholder package version revision in a CodeArtifact get-asset example.
Reasoning
The base64-like value is the packageVersionRevision field of a sample request in CodeArtifact docs. It is the same repeated placeholder revision, with no decoding or execution.
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"readme": "<div align=\"center\">\n <a href=\https://github.com/test-package/testpack\"> ... more content ... \n",
"versionRevision": "Ciqe5/9yicvkJT13b5/LdLpCyE6fqA7poa9qp+FilPs="
}
likely benign
LLM, confidence 0.95
Placeholder version revision in a CodeArtifact get-readme example.
Reasoning
The blob is the versionRevision field in a sample README response in CodeArtifact docs. The surrounding text is clearly illustrative ('... more content ...'), so this is a placeholder.
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"version": "4.0.0",
"versionRevision": "Ciqe5/9yicvkJT13b5/LdLpCyE6fqA7poa9qp+FilPs=",
"assets": [
{
likely benign
LLM, confidence 0.95
Placeholder version revision in a CodeArtifact list-assets example.
Reasoning
The value is a repeated placeholder revision token inside a sample JSON response in CodeArtifact docs. No decoding or execution is present.
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"version": "4.0.0",
"versionRevision": "Ciqe5/9yicvkJT13b5/LdLpCyE6fqA7poa9qp+FilPs=",
"dependencies": [
{
likely benign
LLM, confidence 0.95
Placeholder version revision in a CodeArtifact list-dependencies example.
Reasoning
Same placeholder version revision string in a sample dependencies response in CodeArtifact docs. Benign documentation content.
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"4.0.0": {
"revision": "Ciqe5/9yicvkJT13b5/LdLpCyE6fqA7poa9qp+FilPs=",
"status": "Archived"
}
likely benign
LLM, confidence 0.95
Placeholder package version revision in a CodeArtifact update-status example.
Reasoning
The placeholder revision string appears in a sample status-update JSON response in CodeArtifact docs. It is a repeated documentation value, not a payload.
-
base64-like blob (225 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
"payloadUrl": "https://codebuild.us-west-2.amazonaws.com/webhooks?t=eyJlbmNyeXB0ZWREYXRhIjoiVVl5MGtoeGRwSzZFRXl2Wnh4bld1Z0tKZ291TVpQNEtFamQ3RDlDYWpRaGIreVFrdm9EQktIVk1NeHJEWEpmUDUrVUNOMUIyRHJRc1VxcHJ6QlNDSnljPSIsIml2UGFyYW1ldGVyU3BlYyI6InN4Tm1SeUt5MUhaUVRWbGciLCJtYXRlcmlhbFNldFNlcmlhbCI6MX0%3D&v=1",
likely benign
LLM, confidence 0.92
Sample CodeBuild webhook URL with an opaque base64 token in a create-webhook example.
Reasoning
The base64 segment is an encrypted-data token in a CodeBuild webhook payloadUrl example, URL-encoded with %3D and the usual v=1 parameter. It is a sample URL in an AWS CLI doc, and the token structure is consistent with an AWS-issued opaque value, not a hidden payload.
-
line length 889 characters (raw pass, confidence 0.50)
"sessionToken": "fICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcNMTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNV
-
line length 891 characters (raw pass, confidence 0.50)
"sessionToken": "fICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcNMTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBg
-
line length 1230 characters (raw pass, confidence 0.50)
"MetadataFile": "<md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"http://www.example.com/sso\"><md:IDPSSODescriptor WantAuthnRequestsSigned=\"false\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"><md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"
-
line length 1234 characters (raw pass, confidence 0.50)
"MetadataFile": "<md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"http://www.example.com/sso\"><md:IDPSSODescriptor WantAuthnRequestsSigned=\"false\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"><md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:d
-
base64-like blob (1128 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
--image-file iVBORw0KGgoAAAANSUhEUgAAAFAAAABQCAMAAAC5zwKfAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAA2UExURd00TN9BV/Cmsfvm6f3y9P////fM0uqAj+yNmu6ZpvnZ3eNabuFNYuZneehzhPKzvPTAxwAAAOiMMlkAAAASdFJOU///////////////////////AOK/vxIAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAKDSURBVFhH7ZfpkoMgEISDHKuEw/d/2u2BQWMiBrG29o+fVsKatdPMAeZ
likely benign
LLM, confidence 0.96
Base64-encoded PNG logo data in a Cognito set-ui-customization example.
Reasoning
The 1128-byte base64 string starts with a PNG signature (iVBORw0KGgo) and is image data passed to --image-file in a Cognito UI customization doc example. Embedded image data in documentation is normal.
-
base64-like blob (1128 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
--image-file iVBORw0KGgoAAAANSUhEUgAAAFAAAABQCAMAAAC5zwKfAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAA2UExURd00TN9BV/Cmsfvm6f3y9P////fM0uqAj+yNmu6ZpvnZ3eNabuFNYuZneehzhPKzvPTAxwAAAOiMMlkAAAASdFJOU///////////////////////AOK/vxIAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAKDSURBVFhH7ZfpkoMgEISDHKuEw/d/2u2BQWMiBrG29o+fVsKatdPMAeZxc3N
likely benign
LLM, confidence 0.96
Base64-encoded PNG logo data repeated in a Cognito set-ui-customization example.
Reasoning
Same base64 PNG data as the earlier finding in the same Cognito docs file, here as a CLI argument example. Image content, not code.
-
line length 869 characters (raw pass, confidence 0.50)
"Bytes": "PHN2ZyB3aWR0aD0iMjAwMDAiIGhlaWdodD0iNDAwIiB2aWV3Qm94PSIwIDAgMjAwMDAgNDAwIiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgo8ZyBjbGlwLXBhdGg9InVybCgjY2xpcDBfMTcyNTlfMjM2Njc0KSI+CjxyZWN0IHdpZHRoPSIyMDAwMCIgaGVpZ2h0PSI0MDAiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl8xNzI1OV8yMzY2NzQpIi8+Cj
-
line length 595 characters (raw pass, confidence 0.50)
"url": "https://prod-us-west-2-uploads.s3-us-west-2.amazonaws.com/arn%3Aaws%3Adevicefarm%3Aus-west-2%3A123456789012%3Aproject%3A070fc3ca-c7e1-4471-91cf-d3e4efc50604/uploads/arn%3Aaws%3Adevicefarm%3Aus-west-2%3A123456789012%3Aupload%3A070fc3ca-7ec1-4741-9c1f-d3e044efc506/dd72723a-ae9e-4087-09e6-f4cea3599514/ap
-
base64-like blob (74 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
%2F20170824%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=05050370c38894ef5bd09f5d009f36fc8f96fa4bb04e1bba9aca71b8dbe49a0f",
likely benign
LLM, confidence 0.93
A sample presigned S3 upload URL in AWS CLI documentation, with an example hex signature.
Reasoning
The flagged text is the hex X-Amz-Signature and a query-string fragment inside a documented presigned S3 URL example. Hex is not a real base64 payload, and the context is an AWS CLI docs sample, so this is a false positive.
-
line length 595 characters (raw pass, confidence 0.50)
curl -T app.apk "https://prod-us-west-2-uploads.s3-us-west-2.amazonaws.com/arn%3Aaws%3Adevicefarm%3Aus-west-2%3A123456789012%3Aproject%3A070fc3ca-c7e1-4471-91cf-d3e4efc50604/uploads/arn%3Aaws%3Adevicefarm%3Aus-west-2%3A123456789012%3Aupload%3A070fc3ca-7ec1-4741-9c1f-d3e044efc506/dd72723a-ae9e-4087-09e6-f4cea3599514/a
-
base64-like blob (74 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
%2F20170824%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=05050370c38894ef5bd09f5d009f36fc8f96fa4bb04e1bba9aca71b8dbe49a0f"
likely benign
LLM, confidence 0.93
A sample presigned S3 upload URL in AWS CLI documentation, with an example hex signature.
Reasoning
Same presigned-URL documentation sample as the other devicefarm finding, with the same hex signature fragment. Raw-pass base64 heuristic firing on ordinary URL text in a docs file.
-
line length 722 characters (raw pass, confidence 0.50)
"customerRouterConfig": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<logical_connection id=\"dxvif-fg1vuj3d\">\n <vlan>125</vlan>\n <customer_address>169.254.255.2/30</customer_address>\n <amazon_address>169.254.255.1/30</amazon_address>\n <bgp_asn>65000</bgp_asn>\n <bgp_auth_key>0xC_ukbCerl6EYA0uexample<
-
base64-like blob (212 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
{⟨U+000D⟩
"nextToken": "eyJ2IjoxLCJzIjoxLCJpIjoiOU83OTFodzdycnZCbkN4MExHeHVwQT09IiwiYyI6InIxTEN0UEVHV0I1UFlkaWFnNlUxanJkRWF6eW1iOElHM0FRVW1MdHRJK0dxcnN1RWtvcFBKWFE2ZjRNRGdGTkhCa0tDZmVINEtZOEYwZ0dEYWZpbmU0ZnZMYVhKRjdXRVdENmdQZ1Y4d2w0PSJ9", ⟨U+000D⟩
"directConnectGatewayAssociations": [⟨U+000D⟩
{
likely benign
LLM, confidence 0.93
An example nextToken pagination value in AWS Direct Connect CLI output docs.
Reasoning
The value is an opaque pagination nextToken in a sample JSON CLI output. Such tokens are expected to be base64-like, and the file is documentation.
-
base64-like blob (212 bytes, compression ratio 0.88) (raw pass, confidence 0.60)
], ⟨U+000D⟩
"nextToken": "eyJ2IjoxLCJzIjoxLCJpIjoibEhXdlNpUXF5RzhoL1JyUW52SlV2QT09IiwiYyI6Im5wQjFHQ0RyQUdRS3puNnNXcUlINCtkTTA4dTk3KzBiU0xtb05JQmlaczZ6NXRIYmk3c3VESUxFTTd6a2FzVHM0VTFwaGJkZGNxTytqWmQ3QzMzOGRQaTVrTThrOG1zelRsV3gyMWV3VTNFPSJ9"⟨U+000D⟩
}
likely benign
LLM, confidence 0.93
An example nextToken pagination value in AWS Direct Connect CLI output docs.
Reasoning
An opaque pagination nextToken in a sample CLI response inside a docs file. Expected format for this API, with no executable or hidden content.
-
base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
],
"NextToken": "abCDeFGhiJKlmnOPqrSTuvwxYZ1aBCdEFghijK7LM51nOpqRSTuv3WxY3ZabC5dEFGhI2Jk3LmnoPQ6RST9"
}
dismissed
LLM, confidence 0.96
A placeholder NextToken value in a DynamoDB list-backups documentation example.
Reasoning
The token is an obvious placeholder string with patterned mixed case (abCDeFGh...), used as an example NextToken in documentation output. It is not a real credential or payload.
-
base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
aws dynamodb list-backups \
--starting-token abCDeFGhiJKlmnOPqrSTuvwxYZ1aBCdEFghijK7LM51nOpqRSTuv3WxY3ZabC5dEFGhI2Jk3LmnoPQ6RST9
Output ::
dismissed
LLM, confidence 0.96
A placeholder starting-token argument in a DynamoDB list-backups documentation example.
Reasoning
Same placeholder token used as a --starting-token example argument in documentation. Not an encoded payload.
-
base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
],
"NextToken": "abCDeFGhiJKlmnOPqrSTuvwxYZ1aBCdEFghijK7LM51nOpqRSTuv3WxY3ZabC5dEFGhI2Jk3LmnoPQ6RST9"
}
dismissed
LLM, confidence 0.96
A placeholder NextToken value in a DynamoDB list-contributor-insights documentation example.
Reasoning
Placeholder NextToken in a documentation output sample, identical to other DynamoDB doc placeholders.
-
base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
--max-results 4 \
--next-token abCDeFGhiJKlmnOPqrSTuvwxYZ1aBCdEFghijK7LM51nOpqRSTuv3WxY3ZabC5dEFGhI2Jk3LmnoPQ6RST9
Output::
dismissed
LLM, confidence 0.96
A placeholder next-token argument in a DynamoDB list-contributor-insights documentation example.
Reasoning
Placeholder --next-token example argument in documentation; the value is an obvious sample string.
-
base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
],
"NextToken": "abCDeFGhiJKlmnOPqrSTuvwxYZ1aBCdEFghijK7LM51nOpqRSTuv3WxY3ZabC5dEFGhI2Jk3LmnoPQ6RST9"
}
dismissed
LLM, confidence 0.96
A placeholder NextToken value in a DynamoDB list-tables documentation example.
Reasoning
Placeholder NextToken in documentation output, consistent with the other DynamoDB examples.
-
base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
aws dynamodb list-tables \
--starting-token abCDeFGhiJKlmnOPqrSTuvwxYZ1aBCdEFghijK7LM51nOpqRSTuv3WxY3ZabC5dEFGhI2Jk3LmnoPQ6RST9
Output::
dismissed
LLM, confidence 0.96
A placeholder starting-token argument in a DynamoDB list-tables documentation example.
Reasoning
Placeholder --starting-token example in documentation, not a real encoded blob.
-
base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
],
"NextToken": "abCDeFGhiJKlmnOPqrSTuvwxYZ1aBCdEFghijK7LM51nOpqRSTuv3WxY3ZabC5dEFGhI2Jk3LmnoPQ6RST9"
}
dismissed
LLM, confidence 0.96
A placeholder NextToken value in a DynamoDB list-tags-of-resource documentation example.
Reasoning
Placeholder NextToken in a documentation output sample for list-tags-of-resource.
-
base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)
--resource-arn arn:aws:dynamodb:us-west-2:123456789012:table/MusicCollection \
--starting-token abCDeFGhiJKlmnOPqrSTuvwxYZ1aBCdEFghijK7LM51nOpqRSTuv3WxY3ZabC5dEFGhI2Jk3LmnoPQ6RST9
Output::
dismissed
LLM, confidence 0.95
A placeholder starting-token argument in a DynamoDB list-tags-of-resource documentation example.
Reasoning
Placeholder --starting-token example alongside a sample ARN, all in documentation.
-
line length 745 characters (raw pass, confidence 0.50)
--shard-iterator "arn:aws:dynamodb:us-west-1:123456789012:table/Music/stream/2019-10-22T18:02:01.576|1|AAAAAAAAAAGgM3YZ89vLZZxjmoQeo33r9M4x3+zmmTLsiL86MfrF4+B4EbsByi52InVmiONmy6xVW4IRcIIbs1zO7MNIlqZfx8WQzMwVDyINtGG2hCLg78JKbYxFasXeePGlApTyf3rJxR765uyOVaBvBHAJuwF2TXIuxhaAlOupNGHr52qAC3a49ZOmf+CjNPlqQjnyRSAnfOwWm
-
base64-like blob (632 bytes, compression ratio 0.80) (raw pass, confidence 0.60)
9012:table/Music/stream/2019-10-22T18:02:01.576|1|AAAAAAAAAAGgM3YZ89vLZZxjmoQeo33r9M4x3+zmmTLsiL86MfrF4+B4EbsByi52InVmiONmy6xVW4IRcIIbs1zO7MNIlqZfx8WQzMwVDyINtGG2hCLg78JKbYxFasXeePGlApTyf3rJxR765uyOVaBvBHAJuwF2TXIuxhaAlOupNGHr52qAC3a49ZOmf+CjNPlqQjnyRSAnfOwWmKhL1/KNParWSfz2odf780oOObIDIWRRMkt7+Hyzh9SD+hFxFAWR5C7QIlOXPc
likely benign
LLM, confidence 0.90
A sample DynamoDB Streams shard iterator string in an AWS CLI get-records documentation example.
Reasoning
The long base64 blob is a sample DynamoDB Streams shard iterator value in a documentation example. It is a stream position token, not executable or hidden content, and the file is a docs example.
-
line length 749 characters (raw pass, confidence 0.50)
"NextShardIterator": "arn:aws:dynamodb:us-west-1:123456789012:table/Music/stream/2019-10-23T16:41:08.740|1|AAAAAAAAAAEhEI04jkFLW+LKOwivjT8d/IHEh3iExV2xK00aTxEzVy1C1C7Kbb5+ZOW6bT9VQ2n1/mrs7+PRiaOZCHJu7JHJVW7zlsqOi/ges3fw8GYEymyL+piEk35cx67rQqwKKyq+Q6w9JyjreIOj4F2lWLV26lBwRTrIYC4IB7C3BZZK4715QwYdDxNdVHiSBRZX8UqoS
-
base64-like blob (632 bytes, compression ratio 0.80) (raw pass, confidence 0.60)
9012:table/Music/stream/2019-10-23T16:41:08.740|1|AAAAAAAAAAEhEI04jkFLW+LKOwivjT8d/IHEh3iExV2xK00aTxEzVy1C1C7Kbb5+ZOW6bT9VQ2n1/mrs7+PRiaOZCHJu7JHJVW7zlsqOi/ges3fw8GYEymyL+piEk35cx67rQqwKKyq+Q6w9JyjreIOj4F2lWLV26lBwRTrIYC4IB7C3BZZK4715QwYdDxNdVHiSBRZX8UqoS6WOt0F87xZLNB9F/NhYBLXi/wcGvAcBcC0TNIOH+N0NqwtoB/FGCkNrf8YZ0xRoNN
likely benign
LLM, confidence 0.93
Sample DynamoDB stream record identifier containing a base64-like string in AWS CLI docs.
Reasoning
Raw-pass base64 detection on a DynamoDB Streams sample shard iterator/record ID in a documentation example. The blob is an opaque identifier in example output, not an executed or hidden payload, and the file is ordinary CLI reference documentation.
-
line length 744 characters (raw pass, confidence 0.50)
"ShardIterator": "arn:aws:dynamodb:us-west-1:123456789012:table/Music/stream/2019-10-22T18:02:01.576|1|AAAAAAAAAAGgM3YZ89vLZZxjmoQeo33r9M4x3+zmmTLsiL86MfrF4+B4EbsByi52InVmiONmy6xVW4IRcIIbs1zO7MNIlqZfx8WQzMwVDyINtGG2hCLg78JKbYxFasXeePGlApTyf3rJxR765uyOVaBvBHAJuwF2TXIuxhaAlOupNGHr52qAC3a49ZOmf+CjNPlqQjnyRSAnfOwWm
-
base64-like blob (632 bytes, compression ratio 0.80) (raw pass, confidence 0.60)
9012:table/Music/stream/2019-10-22T18:02:01.576|1|AAAAAAAAAAGgM3YZ89vLZZxjmoQeo33r9M4x3+zmmTLsiL86MfrF4+B4EbsByi52InVmiONmy6xVW4IRcIIbs1zO7MNIlqZfx8WQzMwVDyINtGG2hCLg78JKbYxFasXeePGlApTyf3rJxR765uyOVaBvBHAJuwF2TXIuxhaAlOupNGHr52qAC3a49ZOmf+CjNPlqQjnyRSAnfOwWmKhL1/KNParWSfz2odf780oOObIDIWRRMkt7+Hyzh9SD+hFxFAWR5C7QIlOXPc
likely benign
LLM, confidence 0.93
Sample DynamoDB shard iterator string in AWS CLI docs.
Reasoning
Same pattern as the other DynamoDB Streams docs: a sample shard iterator string in example output. Raw pass, no decoding or execution context, and the file is a documentation example.
-
line length 574 characters (raw pass, confidence 0.50)
--launch-template-data '{"NetworkInterfaces":[{"DeviceIndex":0,"AssociatePublicIpAddress":true,"Groups":["sg-7c227019,sg-903004f8"],"DeleteOnTermination":true}],"ImageId":"ami-b42209de","InstanceType":"m4.large","TagSpecifications":[{"ResourceType":"instance","Tags":[{"Key":"environment","Value":"production"},{
-
base64-like blob (172 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
"SpotFleetRequestId": "sfr-73fbd2ce-aa30-494c-8788-1cee4EXAMPLE",
"NextToken": "CpHNsscimcV5oH7bSbub03CI2Qms5+ypNpNm+53MNlR0YcXAkp0xFlfKf91yVxSExmbtma3awYxMFzNA663ZskT0AHtJ6TCb2Z8bQC2EnZgyELbymtWPfpZ1ZbauVg+P+TfGlWxWWB/Vr5dk5d4LfdgA/DRAHUrYgxzrEXAMPLE=",
"StartTime": "2015-05-26T00:00:00Z"
}
likely benign
LLM, confidence 0.93
Pagination NextToken in an EC2 Spot Fleet example response.
Reasoning
The base64-like value is a NextToken pagination value inside a JSON response example. It is data shown in documentation, with no code path that decodes or runs it.
-
base64-like blob (344 bytes over 5 lines, compression ratio 0.84) (raw pass, confidence 0.60)
"Timestamp": "2013-08-07T22:18:38.000Z",
"PasswordData": "gSlJFq+VpcZXqy+iktxMF6NyxQ4qCrT4+gaOuNOenX1MmgXPTj7XEXAMPLE
UQ+YeFfb+L1U4C4AKv652Ux1iRB3CPTYP7WmU3TUnhsuBd+p6LVk7T2lKUml6OXbk6WPW1VYYm/TRPB1
e1DQ7PY4an/DgZT4mwcpRFigzhniQgDDeO1InvSDcwoUTwNs0Y1S8ouri2W4n5GNlriM3Q0AnNVelVz/
likely benign
LLM, confidence 0.93
Sample encrypted PasswordData field in an EC2 CLI docs example.
Reasoning
The value is an encrypted Windows password data blob, shown as a sample response in the EC2 get-password-data documentation. It is ciphertext placeholder content with no executable context.
-
line length 3742 characters (raw pass, confidence 0.65)
"aboutText": "## Quick reference\n\nMaintained by: [the Amazon Linux Team](https://github.com/aws/amazon-linux-docker-images)\n\nWhere to get help: [the Docker Community Forums](https://forums.docker.com/), [the Docker Community Slack](https://dockr.ly/slack), or [Stack Overflow](https://stackoverflow.com/s
dismissed
LLM, confidence 0.95
Long escaped JSON aboutText field in an ECR Public create-repository example.
Reasoning
The long line is an escaped JSON catalog data string, including Markdown about text, in a repository creation example. This is ordinary long documentation JSON, not hidden code.
-
line length 3742 characters (raw pass, confidence 0.65)
"aboutText": "## Quick reference\n\nMaintained by: [the Amazon Linux Team](https://github.com/aws/amazon-linux-docker-images)\n\nWhere to get help: [the Docker Community Forums](https://forums.docker.com/), [the Docker Community Slack](https://dockr.ly/slack), or [Stack Overflow](https://stackoverflow.com/s
dismissed
LLM, confidence 0.95
Second long escaped JSON aboutText example in ECR Public docs.
Reasoning
Repeats the same long escaped JSON aboutText structure at a second location in the same documentation file. It is benign example content.
-
line length 3756 characters (raw pass, confidence 0.65)
"authorizationToken": "QVdTOmV5SndZWGxzYjJKJFHDSFKJHERWUY65IOU36TRYEGFNSDLRIUOTUYTHJKLDFGOcmFUQk9OSFV2UVV4a0x6Sm1ZV0Z6TDFndlZtUjJSVmgxVEVObU9IZEdTWEZxU210c1JUQm5RWGxOUVV4NlNFUnROWG92ZWtGbWJFUjRkbWMyV0U5amFpczRNWGxTVkM5Tk5qWkVUM2RDYm05TVJqSkxjV3BsUVZvMmFYSm5iV1ZvVFdGSVRqVlFMMHN4VnpsTGVXbDFRWGRoTmpsbWFuQllhbV
likely benign
LLM, confidence 0.92
Long sample authorizationToken value in an ECR Public docs example.
Reasoning
The long line is a sample base64 authorization token in an ECR Public docs example response. It is a placeholder-style credential string in documentation, not live code or a dropper.
-
line length 3721 characters (raw pass, confidence 0.65)
QVdTOmV5SndZWGxzYjJKJFHDSFKJHERWUY65IOU36TRYEGFNSDLRIUOTUYTHJKLDFGOcmFUQk9OSFV2UVV4a0x6Sm1ZV0Z6TDFndlZtUjJSVmgxVEVObU9IZEdTWEZxU210c1JUQm5RWGxOUVV4NlNFUnROWG92ZWtGbWJFUjRkbWMyV0U5amFpczRNWGxTVkM5Tk5qWkVUM2RDYm05TVJqSkxjV3BsUVZvMmFYSm5iV1ZvVFdGSVRqVlFMMHN4VnpsTGVXbDFRWGRoTmpsbWFuQllhbVl6TkdGaGMwUjJha2xsYUhscWRscHZTR
likely benign
LLM, confidence 0.92
Continuation of the sample authorization token in ECR Public docs.
Reasoning
A continuation line of the same sample authorization token in the same documentation example. It is benign docs content.
-
line length 1284 characters (raw pass, confidence 0.50)
"imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 2777,\n \"digest\": \"sha256:6171c7451a50945f8ddd72f7732cc04d7a0d1f
-
base64-like blob (74 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
%2F20190814%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Signature=9161345894947a1672467a0da7a1550f2f7157318312fe4941b59976239c3337",
likely benign
LLM, confidence 0.93
Sample presigned S3 URL signature in an ECR docs example.
Reasoning
The hex signature is a sample X-Amz-Signature query parameter in a presigned URL example. It is a documentation placeholder with no decoding or execution.
-
line length 2688 characters (raw pass, confidence 0.65)
"imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 5695,\n \"digest\": \"sha256:cea5fe7701b7db3dd1c372f3cea6f43cdda444fcc488f530829
dismissed
LLM, confidence 0.95
Long escaped JSON image manifest in an ECR put-image example.
Reasoning
The long line is an escaped JSON image manifest string in a CLI example. Long lines like this are normal for embedded JSON in documentation and show no obfuscation.
-
base64-like blob (64 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
"image": "httpd:2.4",⟨U+000D⟩
"runtimeId": "91251eed27db90006ad67b1a08187290869f216557717dd5c39b37c94EXAMPLE",⟨U+000D⟩
"lastStatus": "RUNNING",⟨U+000D⟩
"networkBindings": [
likely benign
LLM, confidence 0.93
Sample ECS task runtimeId string in describe-tasks docs.
Reasoning
The flagged value is a sample runtimeId identifier in an ECS describe-tasks JSON response, clearly marked with EXAMPLE. It is a raw-pass false positive on documentation output.
-
line length 5048 characters (raw pass, confidence 0.65)
"configurationSchema": "{\"$ref\":\"#/definitions/VpcCni\",\"$schema\":\"http://json-schema.org/draft-06/schema#\",\"definitions\":{\"Affinity\":{\"type\":[\"object\",\"null\"]},\"EniConfig\":{\"additionalProperties\":false,\"properties\":{\"create\":{\"type\":\"boolean\"},\"region\":{\"type\":\"string\"},\"sub
likely benign
LLM, confidence 0.97
Long JSON configurationSchema string in an AWS CLI EKS docs example.
Reasoning
A 5048-character line in an RST documentation example holding an escaped JSON configuration schema is a normal consequence of pasting API output; no obfuscation or execution is involved.
-
line length 939 characters (raw pass, confidence 0.50)
"configurationSchema": "{\"$ref\":\"#/definitions/Coredns\",\"$schema\":\"http://json-schema.org/draft-06/schema#\",\"definitions\":{\"Coredns\":{\"additionalProperties\":false,\"properties\":{\"computeType\":{\"type\":\"string\"},\"corefile\":{\"description\":\"Entire corefile contents to use with installation
-
line length 1401 characters (raw pass, confidence 0.50)
"AllowedValues": "APPEND,BITCOUNT,BITFIELD,BITOP,BITPOS,BLPOP,BRPOP,BRPOPLPUSH,BZPOPMIN,BZPOPMAX,CLIENT,COMMAND,DBSIZE,DECR,DECRBY,DEL,DISCARD,DUMP,ECHO,EVAL,EVALSHA,EXEC,EXISTS,EXPIRE,EXPIREAT,FLUSHALL,FLUSHDB,GEOADD,GEOHASH,GEOPOS,GEODIST,GEORADIUS,GEORADIUSBYMEMBER,GET,GETBIT,GETRANGE,GETSET,HDEL,HEX
-
line length 1356 characters (raw pass, confidence 0.50)
"Value": "{\"CloudWatchMetrics\": {\"Environment\": {\"ApplicationLatencyP99.9\": null,\"InstancesSevere\": 60,\"ApplicationLatencyP90\": 60,\"ApplicationLatencyP99\": null,\"ApplicationLatencyP95\": 60,\"InstancesUnknown\": 60,\"ApplicationLatencyP85\": 60,\"InstancesInfo\": null,\"ApplicationRequests2xx\":
-
line length 600 characters (raw pass, confidence 0.50)
aws elb create-load-balancer-policy --load-balancer-name my-load-balancer --policy-name my-PublicKey-policy --policy-type-name PublicKeyPolicyType --policy-attributes AttributeName=PublicKey,AttributeValue=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwAYUjnfyEyXr1pxjhFWBpMlggUcqoi3kl+dS74kj//c6x7ROtusUaeQCTgIUkayttRDW
-
base64-like blob (407 bytes, compression ratio 0.85) (raw pass, confidence 0.60)
yType --policy-attributes AttributeName=PublicKey,AttributeValue=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwAYUjnfyEyXr1pxjhFWBpMlggUcqoi3kl+dS74kj//c6x7ROtusUaeQCTgIUkayttRDWchuqo1pHC1u+n5xxXnBBe2ejbb2WRsKIQ5rXEeixsjFpFsojpSQKkzhVGI6mJVZBJDVKSHmswnwLBdofLhzvllpovBPTHe+o4haAWvDBALJU0pkSI1FecPHcs2hwxf14zHoXy1e2k36A64n
likely benign
LLM, confidence 0.95
Example RSA public key value in an ELB policy creation command.
Reasoning
The base64 blob is an RSA public key (MIIBIjANBgkqhkiG9w0BAQEF... is the standard SubjectPublicKeyInfo prefix) passed as a policy attribute in AWS CLI documentation. It is data, not a payload.
-
line length 570 characters (raw pass, confidence 0.50)
aws emr add-steps --cluster-id j-XXXXXXXX --steps Type=HIVE,Name='Hive program',ActionOnFailure=CONTINUE,Args=[-f,s3://amzn-s3-demo-bucket/myhivescript.q,-d,INPUT=s3://amzn-s3-demo-bucket/myhiveinput,-d,OUTPUT=s3://amzn-s3-demo-bucket/myhiveoutput,arg1,arg2] Type=HIVE,Name='Hive steps',ActionOnFailure=TERMINATE_CLU
-
line length 598 characters (raw pass, confidence 0.50)
--instance-groups InstanceGroupType=MASTER,InstanceType=d2.xlarge,InstanceCount=1 'InstanceGroupType=CORE,InstanceType=d2.xlarge,InstanceCount=2,AutoScalingPolicy={Constraints={MinCapacity=1,MaxCapacity=5},Rules=[{Name=TestRule,Description=TestDescription,Action={Market=ON_DEMAND,SimpleScalingPolicyConfiguratio
-
base64-like blob (224 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
{
"RecordId": "9D2OJ6t2EqCTZTXwGzeSv/EVHxRoRCw89xd+o3+sXg8DhYOaWKPSmZy/CGlRVEys1u1xbeKh6VofEYKkoeiDrcjrxhQp9iF7sUW7pujiMEQ5LzlrzCkGosxQn+3boDnURDEaD42V7GiixpOyLJkYZcae1i7HzlCEoy9LJhMr8EjDSi4Om/9Vc2uhwwuAtGE0XKpxJ2WD7ZRWtAnYlKAnvgSPRgg7zOWL"
},
{
likely benign
LLM, confidence 0.96
Opaque Firehose RecordId sample in a put-record-batch example.
Reasoning
Firehose RecordId values in documentation output are opaque record identifiers; base64-like strings of this length are expected and no decoding or execution is shown.
-
base64-like blob (224 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
{
"RecordId": "jFirejqxCLlK5xjH/UNmlMVcjktEN76I7916X9PaZ+PVaOSXDfU1WGOqEZhxq2js7xcZ552eoeDxsuTU1MSq9nZTbVfb6cQTIXnm/GsuF37Uhg67GKmR5z90l6XKJ+/+pDloFv7Hh9a3oUS6wYm3DcNRLTHHAimANp1PhkQvWpvLRfzbuCUkBphR2QVzhP9OiHLbzGwy8/DfH8sqWEUYASNJKS8GXP5s"
},
{
likely benign
LLM, confidence 0.96
Second Firehose RecordId sample in the same documentation example.
Reasoning
Same pattern as the other RecordId samples in a documentation JSON response; placeholder-style identifier data.
-
base64-like blob (224 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
{
"RecordId": "oy0amQ40o5Y2YV4vxzufdcMOOw6n3EPr3tpPJGoYVNKH4APPVqNcbUgefo1stEFRg4hTLrf2k6eliHu/9+YJ5R3iiedHkdsfkIqX0XTySSutvgFYTjNY1TSrK0pM2sWxpjqqnk3+2UX1MV5z88xGro3cQm/DTBt3qBlmTj7Xq8SKVbO1S7YvMTpWkMKA86f8JfmT8BMKoMb4XZS/sOkQLe+qh0sYKXWl"
}
]
likely benign
LLM, confidence 0.96
Third Firehose RecordId sample in the same documentation example.
Reasoning
Third RecordId sample in the documented response; base64-like identifier with no execution context.
-
base64-like blob (224 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
{
"RecordId": "RjB5K/nnoGFHqwTsZlNd/TTqvjE8V5dsyXZTQn2JXrdpMTOwssyEb6nfC8fwf1whhwnItt4mvrn+gsqeK5jB7QjuLg283+Ps4Sz/j1Xujv31iDhnPdaLw4BOyM9Amv7PcCuB2079RuM0NhoakbyUymlwY8yt20G8X2420wu1jlFafhci4erAt7QhDEvpwuK8N1uOQ1EuaKZWxQHDzcG6tk1E49IPeD9k",
"Encrypted": false
}
likely benign
LLM, confidence 0.96
Firehose RecordId sample in a put-record output example.
Reasoning
A RecordId field in a put-record documentation response; opaque identifier data, not code.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJOZXh0VG9rZW4iOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAyfQ=="⟨U+000D⟩
}⟨U+000D⟩
likely benign
LLM, confidence 0.97
Base64 pagination NextToken in an FMS list-policies example.
Reasoning
The value decodes to a JSON-like pagination token ({"NextToken": null, ...}) typical of AWS NextToken pagination in docs.
-
base64-like blob (130 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJhd3NBY2NvdW50SWQiOnsicyI6IjMwMjc3NjAxNjM5OCJ9LCJidWlsZElkIjp7InMiOiJidWlsZC01NWYxZTZmMS1jY2FlLTQ3YTctOWI5ZS1iYjFkYTQwMjEXAMPLE2"⟨U+000D⟩
}
likely benign
LLM, confidence 0.97
Base64 NextToken pagination value in a GameLift example.
Reasoning
The token is a standard AWS pagination NextToken (base64 of JSON with accountId and buildId keys); documentation data only.
-
base64-like blob (130 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
--limit 1 \⟨U+000D⟩
--next-token eyJhd3NBY2NvdW50SWQiOnsicyI6IjMwMjc3NjAxNjM5OCJ9LCJidWlsZElkIjp7InMiOiJidWlsZC01NWYxZTZmMS1jY2FlLTQ3YTctOWI5ZS1iYjFkYTQwMjEXAMPLE1⟨U+000D⟩
⟨U+000D⟩
Repeat until the response doesn't include a ``NextToken`` value.
likely benign
LLM, confidence 0.97
NextToken passed as a --next-token argument in GameLift docs.
Reasoning
Same NextToken value reused as a CLI argument in the documented pagination example; no execution or hidden logic.
-
line length 1593 characters (raw pass, confidence 0.50)
"PreSignedLogUrl": "https://gamelift-event-logs-prod-us-west-2.s3.us-west-2.amazonaws.com/logs/fleet-83422059-8329-42a2-a4d6-c4444386a6f8/events/2ecd0130-5986-44eb-99a7-62df27741084/FLEET_VALIDATION_LAUNCH_PATH_NOT_FOUND.txt?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEB8aCXVzLXdlc3QtMiJHMEUCIHV5K%2FLPx8h310D%
-
4 rows of base64-like lines, lines 49-52 (first: base64-like blob (77 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)
RAAGgw3NDEwNjE1OTIxNzEiDI8rsZtzLzlwEDQhXSrlAtl5Ae%2Fgo6FCIzqXPbXfBOnSvFYqeDlriZarEpKqKrUt8mXQv9iqHResqCph9AKo49lwgSYTT2QoSxnrD7%2FUgv%2BZm2pVuczvuKtUA0fcx6s0GxpjIAzdIE%2F5P%2FB7B9M%2BVZ%2F9KF82hbJi0HTE6Y7BjKsEgFCvk4UXILhfjtan9iQl8%2F21ZTurAcJbm7Y5tuLF9SWSK3%2BEa7VXOcCK4D4O1sMjmdRm0q0CKZ%2FIaXoHkNvg0RVTa0hIqdvpaDQlsSBNd
likely benign
LLM, confidence 0.95
Multi-line base64-like token sample in a GameLift fleet events example.
Reasoning
Lines of URL-encoded base64-like text in a documented response are typical of AWS session or signed token samples in docs (the sample contains an XAMPLE-style placeholder pattern), with no decoding or execution context.
-
base64-like blob (130 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJhd3NBY2NvdW50SWQiOnsicyI6IjMwMjc3NjAxNjM5OCJ9LCJidWlsZElkIjp7InMiOiJidWlsZC01NWYxZTZmMS1jY2FlLTQ3YTctOWI5ZS1iYjFkYTQwMjEXAMPLE2"⟨U+000D⟩
}
likely benign
LLM, confidence 0.97
Base64 NextToken pagination value in a GameLift utilization example.
Reasoning
Standard AWS NextToken pagination value in a documentation output sample, identical in form to the other GameLift examples.
-
base64-like blob (130 bytes, compression ratio 0.96) (raw pass, confidence 0.60)
--limit 2 \⟨U+000D⟩
--next-token eyJhd3NBY2NvdW50SWQiOnsicyI6IjMwMjc3NjAxNjM5OCJ9LCJidWlsZElkIjp7InMiOiJidWlsZC01NWYxZTZmMS1jY2FlLTQ3YTctOWI5ZS1iYjFkYTQwMjEXAMPLE2⟨U+000D⟩
⟨U+000D⟩
Repeat until the response no longer includes a ``NextToken`` value in the output.
likely benign
LLM, confidence 0.95
Example pagination NextToken value in AWS CLI documentation.
Reasoning
Raw pass base64-like match on a pagination NextToken example in AWS CLI RST docs; the token is a documented placeholder ending in EXAMPLE-style suffix, with no decoding or execution.
-
base64-like blob (131 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
], ⟨U+000D⟩
"NextToken": "eyJhd3NBY2NvdW50SWQiOnsicyI6IjMwMjc3NjAxNjM5OCJ9LCJidWlsZElkIjp7InMiOiJidWlsZC01NWYxZTZmMS1jY2FlLTQ3YTctOWI5ZS1iYjFkYTQwMjJEXAMPLE="⟨U+000D⟩
}
likely benign
LLM, confidence 0.95
Example NextToken value in a GameLift list-builds output sample.
Reasoning
Sample NextToken JSON value in AWS CLI docs, a pagination token placeholder; raw base64 heuristic false positive.
-
base64-like blob (131 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
--limit 2⟨U+000D⟩
--next-token eyJhd3NBY2NvdW50SWQiOnsicyI6IjMwMjc3NjAxNjM5OCJ9LCJidWlsZElkIjp7InMiOiJidWlsZC01NWYxZTZmMS1jY2FlLTQ3YTctOWI5ZS1iYjFkYTQwMjJEXAMPLE=⟨U+000D⟩
⟨U+000D⟩
Repeat until the response doesn't include a ``NextToken`` value.
likely benign
LLM, confidence 0.95
Example --next-token argument in GameLift docs.
Reasoning
Same documented pagination token example used in the --next-token usage; benign documentation.
-
base64-like blob (131 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
],⟨U+000D⟩
"NextToken": "eyJhd3NBY2NvdW50SWQiOnsicyI6IjMwMjc3NjAxNjM5OCJ9LCJidWlsZElkIjp7InMiOiJidWlsZC01NWYxZTZmMS1jY2FlLTQ3YTctOWI5ZS1iYjFkYTQwMjJEXAMPLE="⟨U+000D⟩
}
likely benign
LLM, confidence 0.95
Example NextToken value in GameLift list-fleets output.
Reasoning
Example NextToken output in AWS CLI reference docs; placeholder token with EXAMPLE-like suffix.
-
base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
--limit 2 \⟨U+000D⟩
--next-token eyJhd3NBY2NvdW50SWQiOnsicyI6IjMwMjc3NjAxNjM5OCJ9LCJidWlsZElkIjp7InMiOiJidWlsZC00NDRlZjQxZS1hM2I1LTQ2NDYtODJmMy0zYzI4ZTgxNjVjEXAMPLE=⟨U+000D⟩
⟨U+000D⟩
**Example2: To get a list of all fleets in a Region with a specific build or script**
likely benign
LLM, confidence 0.95
Example --next-token argument in GameLift list-fleets docs.
Reasoning
Example --next-token value in AWS CLI docs; benign pagination placeholder.
-
string literal compression ratio 0.961 (128 bytes) (raw pass, confidence 0.60)
{
"location": "/0123456789012/vaults/my-vault/jobs/zbxcm3Z_3z5UkoroF7SuZKrxgGoDc3RloGduS7Eg-RO47Yc6FxsdGBgf_Q2DK5Ejh18CnTS5XW4_XqlNHS61dsO4CnMW",
"jobId": "zbxcm3Z_3z5UkoroF7SuZKrxgGoDc3RloGduS7Eg-RO47Yc6FxsdGBgf_Q2DK5Ejh18CnTS5XW4_XqlNHS61dsO4CnMW"
}
likely benign
LLM, confidence 0.95
Example Glacier job location and jobId in CLI documentation.
Reasoning
Glacier job ID and location in an example JSON output; high-entropy-looking string is a standard AWS-style identifier in documentation, not obfuscated code.
-
base64-like blob (76 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
Request ID: 021AAB703DB20A2D; ⟨U+000D⟩
S3 Extended Request ID: teZk24Y09TkXzBvMPG502L5VJBhe9DJuWA9/TXtuGOqfByajkfL/Tlqt5JBGdEGpigAqzdMDM/U=)",⟨U+000D⟩
"PredecessorRuns": [],⟨U+000D⟩
"AllocatedCapacity": 10,
likely benign
LLM, confidence 0.95
S3 request ID text inside an example Glue job run error message.
Reasoning
S3 Extended Request ID from a real-looking error message sample in Glue docs; it is an identifier string in prose, not an encoded payload.
-
base64-like blob (76 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
Request ID: 2671D37856AE7ABB; ⟨U+000D⟩
S3 Extended Request ID: RLJCJw20brV+PpC6GpORahyF2fp9flB5SSb2bTGPnUSPVizLXRl1PN3QZldb+v1o9qRVktNYbW8=)",⟨U+000D⟩
"PredecessorRuns": [],⟨U+000D⟩
"AllocatedCapacity": 10,
likely benign
LLM, confidence 0.95
S3 extended request ID in an example Glue job run error message.
Reasoning
Same kind of S3 Extended Request ID in a Glue error message example; benign documentation text.
-
base64-like blob (69 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
{
"certificateArn": "arn:aws:iot:us-west-2:123456789012:cert/123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz",
"certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDWTCAkGgAwIBATgIUCgq6EGqou6zFqWgIZRndgQEFW+gwDQYJKoZIhvc...KdGewQS\n-----END CERTIFICATE-----\n",
"keyPair": {
likely benign
LLM, confidence 0.95
Placeholder certificate PEM in Greengrass core definition example.
Reasoning
Truncated placeholder certificate PEM (contains '...') in Greengrass docs; not a real key or executable payload.
-
base64-like blob (64 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
},
"certificateId": "123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz"
}
likely benign
LLM, confidence 0.95
Example certificateId in Greengrass documentation.
Reasoning
Certificate ID placeholder with EXAMPLE marker in AWS docs; benign identifier.
-
base64-like blob (69 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
--policy-name "Core_Devices" \
--target "arn:aws:iot:us-west-2:123456789012:cert/123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz"
This command produces no output.
likely benign
LLM, confidence 0.95
Example IoT certificate ARN as policy attach target.
Reasoning
IoT certificate ARN placeholder used as a policy target in CLI docs; benign.
-
base64-like blob (69 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
--thing-name "MyCoreDevice" \
--principal "arn:aws:iot:us-west-2:123456789012:cert/123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz"
This command produces no output.
dismissed
LLM, confidence 0.95
A documentation example ARN containing a placeholder certificate ID is flagged as a base64-like blob.
Reasoning
The flagged blob is a hexadecimal certificate ID inside an AWS IoT ARN in an AWS CLI documentation example. The string contains the placeholder token 'EXAMPLE' and the account 123456789012, and it appears in a plain reStructuredText docs file with no decoding or execution. This is a raw-pass false positive on a base64-like match.
-
base64-like blob (69 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
--cores "[{\"Id\":\"MyCoreDevice\",\"ThingArn\":\"arn:aws:iot:us-west-2:123456789012:thing/MyCoreDevice\",\"CertificateArn\":\"arn:aws:iot:us-west-2:123456789012:cert/123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz\",\"SyncShadow\":true}]"
Output::
dismissed
LLM, confidence 0.97
Documentation CLI example containing a Greengrass core ARN with placeholder values.
Reasoning
Snippet is an AWS CLI doc example with a JSON cores argument; the long string is an ARN with an EXAMPLE placeholder suffix, not an encoded payload. Raw-pass base64 heuristic false positive in documentation.
-
base64-like blob (69 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
{
"certificateArn": "arn:aws:iot:us-west-2:123456789012:cert/123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz",
"certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDWTCAkGgAwIBATgIUCgq6EGqou6zFqWgIZRndgQEFW+gwDQYJKoZIhvc...KdGewQS\n-----END CERTIFICATE-----\n",
"keyPair": {
dismissed
LLM, confidence 0.97
Documentation sample JSON output with placeholder certificate data.
Reasoning
Sample JSON output from AWS CLI docs showing certificate ARN and truncated PEM with ellipsis; the flagged token is an ARN/identifier. Benign documentation.
-
base64-like blob (64 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
},
"certificateId": "123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz"
}
dismissed
LLM, confidence 0.97
Documentation sample certificateId placeholder.
Reasoning
Certificate ID placeholder with EXAMPLE marker in an AWS docs output sample; flagged as base64-like only due to length and character set.
-
base64-like blob (69 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
--policy-name "Core_Devices" \
--target "arn:aws:iot:us-west-2:123456789012:cert/123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz"
This command produces no output.
dismissed
LLM, confidence 0.97
Documentation CLI command attaching an IoT policy to a placeholder certificate ARN.
Reasoning
Certificate ARN used as a policy attach target in an AWS CLI example; identifier with EXAMPLE placeholder, not obfuscation.
-
base64-like blob (69 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
--thing-name "MyCoreDevice" \
--principal "arn:aws:iot:us-west-2:123456789012:cert/123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz"
This command produces no output.
dismissed
LLM, confidence 0.97
Documentation CLI command with placeholder principal ARN.
Reasoning
Principal ARN in a documentation command example with placeholder certificate ID; no decoding or execution.
-
base64-like blob (69 bytes, compression ratio 1.03) (raw pass, confidence 0.60)
--initial-version "{\"Cores\":[{\"Id\":\"MyCoreDevice\",\"ThingArn\":\"arn:aws:iot:us-west-2:123456789012:thing/MyCoreDevice\",\"CertificateArn\":\"arn:aws:iot:us-west-2:123456789012:cert/123a15ec415668c2349a76170b64ac0878231c1e21ec83c10e92a1EXAMPLExyz\",\"SyncShadow\":true}]}"
Output::
dismissed
LLM, confidence 0.97
Documentation CLI example with Greengrass initial version JSON.
Reasoning
Initial-version JSON argument in AWS CLI docs with ARNs containing EXAMPLE placeholders; standard documentation content.
-
line length 515 characters (raw pass, confidence 0.50)
--devices "[{\"Id\":\"InteriorTherm\",\"ThingArn\":\"arn:aws:iot:us-west-2:123456789012:thing/InteriorTherm\",\"CertificateArn\":\"arn:aws:iot:us-west-2:123456789012:cert/66a415ec415668c2349a76170b64ac0878231c1e21ec83c10e92a18bd568eb92\",\"SyncShadow\":true},{\"Id\":\"ExteriorTherm\",\"ThingArn\":\"arn:aws:iot:
-
line length 537 characters (raw pass, confidence 0.50)
--initial-version "{\"Devices\":[{\"Id\":\"InteriorTherm\",\"ThingArn\":\"arn:aws:iot:us-west-2:123456789012:thing/InteriorTherm\",\"CertificateArn\":\"arn:aws:iot:us-west-2:123456789012:cert/66a415ec415668c2349a76170b64ac0878231c1e21ec83c10e92a18bd568eb92\",\"SyncShadow\":true},{\"Id\":\"ExteriorTherm\",\"Thin
-
base64-like blob (100 bytes, compression ratio 0.92) (raw pass, confidence 0.60)
{
"GroupCertificateAuthorityArn": "arn:aws:greengrass:us-west-2:123456789012:/greengrass/groups/8eaadd72-ce4b-4f15-892a-0cc4f3a343f1/certificateauthorities/d31630d674c4437f6c5dbc0dca56312a902171ce2d086c38e509c8EXAMPLEcc5"
}
dismissed
LLM, confidence 0.96
Documentation sample output with a placeholder CA ARN.
Reasoning
Sample output containing a certificate authority ARN with EXAMPLE suffix; the matched string is a resource identifier in docs.
-
line length 632 characters (raw pass, confidence 0.50)
--subscriptions "[{\"Id\": \"TriggerNotification\", \"Source\": \"arn:aws:lambda:us-west-2:123456789012:function:TempMonitor:GG_TempMonitor\", \"Subject\": \"twilio/txt\", \"Target\": \"arn:aws:greengrass:us-west-2::/connectors/TwilioNotifications/versions/1\"},{\"Id\": \"TemperatureInput\", \"Source\": \"cloud
-
line length 655 characters (raw pass, confidence 0.50)
--initial-version "{\"Subscriptions\": [{\"Id\": \"TriggerNotification\", \"Source\": \"arn:aws:lambda:us-west-2:123456789012:function:TempMonitor:GG_TempMonitor\", \"Subject\": \"twilio/txt\", \"Target\": \"arn:aws:greengrass:us-west-2::/connectors/TwilioNotifications/versions/1\"},{\"Id\": \"TemperatureInput\
-
base64-like blob (95 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
ebugConsole/2.0.3/s3/ggv2-component-releases-prod-pdx/EvergreenHttpDebugView/2ffc496ba41b39568968b22c582b4714a937193ee7687a45527238e696672521/aws.greengrass.LocalDebugConsole/aws.greengrass.LocalDebugConsole.jar?X-Amz-Security-Token=KwfLKSdEXAMPLE..."⟨U+000D⟩
dismissed
LLM, confidence 0.96
Documentation example of a presigned S3 artifact URL with placeholder token.
Reasoning
Truncated presigned S3 URL with placeholder security token in an AWS docs example; URL-safe characters trigger the heuristic, no payload execution.
-
line length 874 characters (raw pass, confidence 0.50)
"Metadata": "{\"issuer\":\"https://ehr.example.com\", \"jwks_uri\":\"https://ehr.example.com/.well-known/jwks.json\",\"authorization_endpoint\":\"https://ehr.example.com/auth/authorize\",\"token_endpoint\":\"https://ehr.token.com/auth/token\",\"token_endpoint_auth_methods_supported\":[\"client_secret_basic\",\"
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"ServiceUserName": "sofia-at-123456789012",
"ServicePassword": "k1zPZM6uVxMQ3oxqgoYlNuJPyRTZ1vREs76zTQE3eJk=",
"ServiceSpecificCredentialId": "ACCAEXAMPLE123EXAMPLE",
"UserName": "sofia",
likely benign
LLM, confidence 0.95
Documentation sample output showing a service-specific credential password.
Reasoning
Sample output with a 44-char base64 service password in AWS IAM docs; it is a documentation placeholder value, typical of a 32-byte key encoded as base64, and the surrounding file is a plain CLI reference.
-
line length 701 characters (raw pass, confidence 0.50)
--encoded-message lxzA8VEjEvu-s0TTt3PgYCXik9YakOqsrFJGRZR98xNcyWAxwRq14xIvd-npzbgTevuufCTbjeBAaDARg9cbTK1rJbg3awM33o-Vy3ebPErE2-mWR9hVYdvX-0zKgVOWF9pWjZaJSMqxB-aLXo-I_8TTvBq88x8IFPbMArNdpu0IjxDjzf22PF3SOE3XvIQ-_PEO0aUqHCCcsSrFtvxm6yQD1nbm6VTIVrfa0Bzy8lsoMo7SjIaJ2r5vph6SY5vCCwg6o2JKe3hIHTa8zRrDbZSFMkcXOT6EOPkQXm
-
base64-like blob (255 bytes, compression ratio 0.85) (raw pass, confidence 0.60)
LXo-I_8TTvBq88x8IFPbMArNdpu0IjxDjzf22PF3SOE3XvIQ-_PEO0aUqHCCcsSrFtvxm6yQD1nbm6VTIVrfa0Bzy8lsoMo7SjIaJ2r5vph6SY5vCCwg6o2JKe3hIHTa8zRrDbZSFMkcXOT6EOPkQXmaBsAC6ciG7Pz1JnEOvuj5NSTlSMljrAXczWuRKAs5GsMYiU8KZXZhokVzdQCUZkS5aVHumZbadu0io53jpgZqhMqvS4fyfK4auK0yKRMtS6JCXPlhkolEs7ZMFA0RVkutqhQqpSDPB5SX5l00lYipWyFK0_AyAx60vumPuVh8
dismissed
LLM, confidence 0.96
Documentation sample of an encoded STS authorization message.
Reasoning
Long URL-safe base64 string in an AWS decode-authorization-message docs example; it is a sample encoded authorization message, not executable code, and the rst context is documentation.
-
base64-like blob (87 bytes, compression ratio 1.05) (raw pass, confidence 0.60)
l4D0m42NFIKxbWXsoJdqaOqVFyFEd0-Xx9AYAAIr6bhcis7C__bZh4dlAAWooHFGKgfoJcWGwgdzgbu9hWyVvKTpeot5hsb8qANYjJRCPXTKpi6PZfdijIkwb6gDMEsJ9qMtr62qP_989mwmtNgnVvBa_ir6oxJxVe_kL9SH1j5nsGDxQFajvPQhxWOHvEQIg_H0bnKWk
dismissed
LLM, confidence 0.96
Documentation sample of an encoded STS authorization message.
Reasoning
Continuation of the sample encoded authorization message in AWS IAM documentation; benign placeholder content.
-
line length 1613 characters (raw pass, confidence 0.50)
"DecodedMessage": "{\"allowed\":false,\"explicitDeny\":false,\"matchedStatements\":{\"items\":[]},\"failures\":{\"items\":[]},\"context\":{\"principal\":{\"id\":\"AIDAV3ZUEFP6J7GY7O6LO\",\"name\":\"chain-user\",\"arn\":\"arn:aws:iam::403299380220:user/chain-user\"},\"action\":\"ec2:RunInstances\",\"resource\":\
-
base64-like blob (112 bytes, compression ratio 1.04) (raw pass, confidence 0.60)
],
"Marker": "EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE",
"IsTruncated": true
}
likely benign
LLM, confidence 0.95
A pagination Marker placeholder in an IAM CLI example output.
Reasoning
The flagged value is a "Marker" pagination token in an AWS CLI documentation JSON example. The token contains the placeholder substring EXAMPLE, and the blob is a documentation sample, not an encoded payload.
-
base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
],
"NextToken": "EXAMPLErZXIiOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiA4fQ=="
}
likely benign
LLM, confidence 0.95
A NextToken pagination placeholder in an IAM list-policies example.
Reasoning
The flagged value is a NextToken pagination placeholder in an IAM CLI documentation example. It contains EXAMPLE and decodes to a harmless-looking pagination parameter, so it is a doc sample rather than a payload.
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"ServiceUserName": "sofia-at-123456789012",
"ServicePassword": "+oaFsNk7tLco+C/obP9GhhcOzGcKOayTmE3LnAmAmH4=",
"ServiceSpecificCredentialId": "ACCAEXAMPLE123EXAMPLE",
"UserName": "sofia",
likely benign
LLM, confidence 0.95
A sample service-specific credential password in an IAM reset-credential doc example.
Reasoning
The ServicePassword is a sample value in an IAM CLI documentation response. It sits next to placeholder IDs such as ACCAEXAMPLE123EXAMPLE and sofia-at-123456789012, so it is an illustrative credential, not a live secret.
-
base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
"ServiceUserName": "sofia-at-123456789012",
"ServicePassword": "+oaFsNk7tLco+C/obP9GhhcOzGcKOayTmE3LnAmAmH4=",
"ServiceSpecificCredentialId": "ACCAEXAMPLE123EXAMPLE",
"UserName": "sofia",
likely benign
LLM, confidence 0.95
A repeated sample service password in a second IAM reset-credential doc example.
Reasoning
This is the same sample ServicePassword and placeholder identifiers as the other reset-credential example, repeated in a second documentation block. It is a doc sample.
-
line length 725 characters (raw pass, confidence 0.50)
"reason": "SSM execution 'a1b2c3d4-5678-90ab-cdef-EXAMPLE11111' failed with status = 'Failed' and failure message = 'Step fails when it is verifying the command has completed. Command a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 returns unexpected invocation result: \n{Status=[Failed], ResponseCode=[1], Out
-
base64-like blob (64 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
aws iot accept-certificate-transfer \⟨U+000D⟩
--certificate-id 488b6a7f2acdeb00a77384e63c4e40b18bEXAMPLEe57b7272ba44c45e3448142⟨U+000D⟩
⟨U+000D⟩
This command does not produce any output.
likely benign
LLM, confidence 0.93
A placeholder certificate ID in an IoT CLI command example.
Reasoning
The flagged string is a certificate ID hex value in a documentation command line for accept-certificate-transfer. It has an EXAMPLE placeholder segment and is a 64-character hex identifier, not an encoded payload.
-
line length 954 characters (raw pass, confidence 0.50)
--confirmation-token "AYADeIcmtq-ZkxfpiWIQqHWM5ucAXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREFxY1E0UmlGeDg0V21BZWZ1VjZtZWFRVUJJUktUYXJaN09OZlJOczJhRENSZmZYL3JHZC9PR3NNcis5T3ZlSitnQT09AAEAB2F3cy1rbXMAS2Fybjphd3M6a21zOnVzLWVhc3QtMTo5ODc5NTE4NTI0OTk6a2V5L2U4YmU3ODViLTU5NWMtNDcxYi1iOWJmLWQ2Y2I4ZjQxODlmNwC4AQIBAHhwz48UWT
-
4 rows of base64-like lines, lines 6-6 (first: base64-like blob (308 bytes, compression ratio 0.85)) (raw pass, confidence 0.60)
--confirmation-token "AYADeIcmtq-ZkxfpiWIQqHWM5ucAXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREFxY1E0UmlGeDg0V21BZWZ1VjZtZWFRVUJJUktUYXJaN09OZlJOczJhRENSZmZYL3JHZC9PR3NNcis5T3ZlSitnQT09AAEAB2F3cy1rbXMAS2Fybjphd3M6a21zOnVzLWVhc3QtMTo5ODc5NTE4NTI0OTk6a2V5L2U4YmU3ODViLTU5NWMtNDcxYi1iOWJmLWQ2Y2I4ZjQxODlmNwC4AQIBAHhwz48UWT
likely benign
LLM, confidence 0.85
A long confirmation-token value in an IoT topic-rule-destination doc command.
Reasoning
The confirmation token is a long base64-like value in a documentation command. It resembles a real AWS-encrypted token, but it sits in a CLI doc example and the raw pass has a high false-positive rate, so a documentation sample is most likely.
-
base64-like blob (392 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)
--token-signing-public-keys FIRST_KEY="-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1uJOB4lQPgG/lM6ZfIwo
Z+7ENxAio9q6QD4FFqjGZsvjtYwjoe1RKK0U8Eq9xb5O3kRSmyIwTzwzm/f4Gf0Y
ZUloJ+t3PUUwHrmbYTAgTrCUgRFygjfgVwGCPs5ZAX4Eyqt5cr+AIHIiUDbxSa7p
likely benign
LLM, confidence 0.93
An example public signing key PEM in an IoT create-authorizer doc.
Reasoning
The flagged lines are a PEM-formatted public key placed in a create-authorizer CLI documentation example. Public keys are not secrets, and the content is a standard example key block.
-
4 rows of base64-like lines, lines 33-33 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
XAMPLEQEFAAOCAQ8AMIIBCgKCAQEAEXAMPLE1nnyJwKSMHw4h\nMMEXAMPLEuuN/dMAS3fyce8DW/4+EXAMPLEyjmoF/YVF/gHr99VEEXAMPLE5VF13\n59VK7cEXAMPLE67GK+y+jikqXOgHh/xJTwo+sGpWEXAMPLEDz18xOd2ka4tCzuWEXAMPLEahJbYkCPUBSU8opVkR7qkEXAMPLE1DR6sx2HocliOOLtu6Fkw91swQWEXAMPLE\GB3ZPrNh0PzQYvjUStZeccyNCx2EXAMPLEvp9mQOUXP6plfgxwKRX2fEXAMPLEDa\nhJLX
likely benign
LLM, confidence 0.93
A placeholder certificate or key blob in an IoT create-keys-and-certificate doc example.
Reasoning
The flagged text is an escaped-newline certificate or key string in a documentation output sample. It contains repeated EXAMPLE placeholder segments, which marks it as a synthetic doc value.
-
line length 1084 characters (raw pass, confidence 0.50)
"certificatePem": "-----BEGIN CERTIFICATE-----\nMIICzzCCAbegEXAMPLEJANVEPWXl8taPMA0GCSqGSIb3DQEBBQUAMB4xCzAJBgNV\nBAYTAlVTMQ8wDQYDVQQKDAZBbWF6b24wHhcNMTkwOTI0MjEzMTE1WhcNMjkwOTIx\nMjEzMTE1WjAeMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMIIBIjANBgkq\nhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzd3R3ioalCS0MhFWfBrVGR036EK07UA
-
line length 601 characters (raw pass, confidence 0.50)
--template-body '{"Parameters":{"ThingName":{"Type":"String"},"AWS::IoT::Certificate::Id":{"Type":"String"}},"Resources": {"certificate":{"Properties":{"CertificateId":{"Ref":"AWS::IoT::Certificate::Id"},"Status":"Active"},"Type":"AWS::IoT::Certificate"},"policy":{"Properties":{"PolicyName":"MyIotPolicy"},"Type
-
line length 1275 characters (raw pass, confidence 0.50)
"text": "{\nquery MyFlow($camera: string!, $screen: string!) @workflowType(id: \"urn:tdm:us-west-2/123456789012/default:Workflow:MyFlow\") @annotation(type: \"tgc:FlowEvent\", id: \"sledged790c1b2bcd949e09da0c9bfc077f79d\", x: 1586, y: 653) @triggers(definition: \"{MotionSensor(description: \\\"\\\") @p
-
line length 1000 characters (raw pass, confidence 0.50)
"WorkUnitToken": "1234eMAk4kLO4umqEL4Z5WuxL04AXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREEwYm9QbkhINmFYTWphbmMxZW1PQmEyMGlUb0JFbXNlWmRYc0NmckRIR1dmQ0hjY2YzNFdMcmNXb2JGZmhEK0QvZz09AAEAB2F3cy1rbXMAS2Fybjphd3M6a21zOnVzLWVhc3QtMTo3MDkxNTAyNDkyNDk6a2V5L2VmYmI3NDUyLTY1MjYtNGJiOS1iNmZhLTEzYzJkMTM3MmU2OQC4AQIBAHg6eWNF2Z
-
line length 993 characters (raw pass, confidence 0.50)
"privateKeyBase64": "-----BEGIN RSA PRIVATE KEY-----EXAMPLETCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC\nVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6\nb24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsEXAMPLEd\nBgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIx
-
line length 1735 characters (raw pass, confidence 0.50)
"privateKey": "-----BEGIN RSA PRIVATE KEY-----\nEXAMPLEBAAKCAQEA+AD3qeU2toBy5O5v7wnRLVo/tngVickL5+6Jf4tPrPeuoebM\nfKlA+/ZTwe6uVBEneVWRhbcra8pH0CZ44sKnuxFeWoM7425S49uhW9+xCnWvR1Xw\njrvKVm75Mu08p/cNvfWugrBuaPB65DspgxNnOfZWMVxpIpSqOSPWmSwQHV597d6C\nrEXAMPLEo8hJmqz2KFQ09X7fB2lBruGgr9aXiNPmWmovYKqwFmrnFvR7odFmDe
-
line length 521 characters (raw pass, confidence 0.50)
For more information about creating performance analysis reports, see `Creating a performance analysis report in Performance Insights <https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.UsingDashboard.CreatingPerfAnlysisReport.html>`__ in the *Amazon RDS User Guide* and `Creating a performance ana
-
line length 519 characters (raw pass, confidence 0.50)
For more information about deleting performance analysis reports, see `Deleting a performance analysis report in Performance Insights <https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.UsingDashboard.DeletePerfAnalysisReport.html>`__ in the *Amazon RDS User Guide* and `Deleting a performance anal
-
line length 538 characters (raw pass, confidence 0.50)
For more information about tagging performance analysis reports, see `Adding tags to a performance analysis report in Performance Insights <https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.UsingDashboard.ManagePerfAnalysisReportTags.html>`__ in the *Amazon RDS User Guide* and `Adding tags to a p
-
line length 538 characters (raw pass, confidence 0.50)
For more information about tagging performance analysis reports, see `Adding tags to a performance analysis report in Performance Insights <https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.UsingDashboard.ManagePerfAnalysisReportTags.html>`__ in the *Amazon RDS User Guide* and `Adding tags to a p
-
line length 538 characters (raw pass, confidence 0.50)
For more information about tagging performance analysis reports, see `Adding tags to a performance analysis report in Performance Insights <https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.UsingDashboard.ManagePerfAnalysisReportTags.html>`__ in the *Amazon RDS User Guide* and `Adding tags to a p
-
line length 564 characters (raw pass, confidence 0.50)
"Content": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<lexicon version=\"1.0\" \n xmlns= \"http://www.w3.org/2005/01/pronunciation-lexicon\"\n xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" \n xsi:schemaLocation=\"http://www.w3.org/2005/01/pronunciation-lexicon \n htt
-
line length 1139 characters (raw pass, confidence 0.50)
"{\"product\":{\"productFamily\":\"Storage\",\"attributes\":{\"storageMedia\":\"SSD-backed\",\"maxThroughputvolume\":\"320 MB/sec\",\"volumeType\":\"Provisioned IOPS\",\"maxIopsvolume\":\"20000\",\"servicecode\":\"AmazonEC2\",\"usagetype\":\"APS1-EBS:VolumeUsage.piops\",\"locationType\":\"AWS Region\",\"locatio
-
line length 550 characters (raw pass, confidence 0.50)
For more information about the values in the output, see `Values That You Specify When You Create or Edit Inbound Endpoints <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-inbound-queries.html#resolver-forwarding-inbound-queries-values>`__, and `Values That You Specify When You Create or
-
line length 519 characters (raw pass, confidence 0.50)
--configuration-policy '{"SecurityHub": {"ServiceEnabled": true, "EnabledStandardIdentifiers": ["arn:aws:securityhub:eu-central-1::standards/aws-foundational-security-best-practices/v/1.0.0","arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"],"SecurityControlsConfiguration":{"DisabledSecurity
-
line length 701 characters (raw pass, confidence 0.50)
"ProductSubscriptionResourcePolicy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"123456789333\"},\"Action\":[\"securityhub:BatchImportFindings\"],\"Resource\":\"arn:aws:securityhub:us-west-1:123456789012:product-subscription/crowdstrike/crowdstrike-falcon\"
-
line length 519 characters (raw pass, confidence 0.50)
--configuration-policy '{"SecurityHub": {"ServiceEnabled": true, "EnabledStandardIdentifiers": ["arn:aws:securityhub:eu-central-1::standards/aws-foundational-security-best-practices/v/1.0.0","arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"],"SecurityControlsConfiguration":{"DisabledSecurity
-
line length 523 characters (raw pass, confidence 0.50)
"Policy": "{\"Version\":\"2008-10-17\",\"Id\":\"__default_policy_ID\",\"Statement\":[{\"Sid\":\"__default_statement_ID\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":[\"SNS:Subscribe\",\"SNS:ListSubscriptionsByTopic\",\"SNS:DeleteTopic\",\"SNS:GetTopicAttributes\",\"SNS:Publish\",\"SNS:Remo
-
line length 686 characters (raw pass, confidence 0.50)
--plan '{"Stages": [{"DurationInMinutes": 5, "Targets": [{"ChannelTargetInfo": {"ContactChannelId": "arn:aws:ssm-contacts:us-east-2:111122223333:contact-channel/akuam/beb25840-5ac8-4644-95cc-7a8de390fa65","RetryIntervalInMinutes": 1 }}]}, {"DurationInMinutes": 5, "Targets": [{"ChannelTargetInfo":{"ContactChanne
-
line length 780 characters (raw pass, confidence 0.50)
"policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"d901b37a-dbb0-458a-8842-75575c464219-external-principals\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::222233334444:root\"},\"Action\":[\"ssm-incidents:GetResponsePlan\",\"ssm-incidents:StartIncident\",\"ssm-incident
-
line length 727 characters (raw pass, confidence 0.50)
--policy "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"ExampleResourcePolciy\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::222233334444:root\"},\"Action\":[\"ssm-incidents:GetResponsePlan\",\"ssm-incidents:StartIncident\",\"ssm-incidents:UpdateIncidentRecord\",\"ssm-incidents:GetIncident
-
line length 1377 characters (raw pass, confidence 0.50)
"Content": "{\n \"schemaVersion\": \"1.2\",\n \"description\": \"Update the Amazon SSM Agent to the latest version or specified version.\",\n \"parameters\": {\n \"version\": {\n \"default\": \"\",\n \"description\": \"(Optional) A specific version of the Amazon SSM
-
line length 1461 characters (raw pass, confidence 0.50)
"Content": "{\n \"schemaVersion\":\"1.2\",\n \"description\":\"Run a shell script or specify the commands to run.\",\n \"parameters\":{\n \"commands\":{\n \"type\":\"StringList\",\n \"description\":\"(Required) Specify a shell script or a command to run.\",\n \"m
-
line length 684 characters (raw pass, confidence 0.50)
--saml-assertion "VERYLONGENCODEDASSERTIONEXAMPLExzYW1sOkF1ZGllbmNlPmJsYW5rPC9zYW1sOkF1ZGllbmNlPjwvc2FtbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1sOlN1YmplY3Q+PHNhbWw6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6dHJhbnNpZW50Ij5TYW1sRXhhbXBsZTwvc2FtbDpOYW1lSUQ+PHNhb
-
line length 882 characters (raw pass, confidence 0.50)
--encoded-message EXAMPLEWodyRNrtlQARDip-eTA6i6DrlUhHhPQrLWB_lAbl5pAKxl9mPDLexYcGBreyIKQC1BGBIpBKr3dFDkwqeO7e2NMk5j_hmzAiChJN-8oy3EwiCjkUW5fdRNjcRvscGlUo_MhqHqHpR-Ojau7BMjOTWwOtHPhV_Zaz87yENdipr745EjQwRd5LaoL3vN8_5ZfA9UiBMKDgVh1gjqZJFUiQoubv78V1RbHNYnK44ElGKmUWYa020I1y6TNS9LXoNmc62GzkfGvoPGhD13br5tXEOo1rAm3vsPe
-
line length 1010 characters (raw pass, confidence 0.50)
"NextToken": "3/PblzkiGhzjER3KHuQt2fmbPLF7cDYafjFMEoGn44ON/gsuUSTIkGyanvRE6WMXFd/ZTEc2EZj+P9eii/z1O2FDYli6RLI0WoRX4RwMisVrh9G0Kie0Y8ikBCdtqlZB10Wa9McC+ebOl+LaDtZPC4u6ttoHLRlEfzqstHXSgapXg3tEBtm9piIaPB6MOM5BB6t86+qtmocTR/qrteHZBBudhTfbCwhsxaqujHiiUvFdm3BQbKKWIW06yV9b+4f38oD2lVIan+vfUs3gBYAl5VTDmXXzQPBQOHPjtwmFI+
-
line length 592 characters (raw pass, confidence 0.50)
"ORIGINAL": "https://gb-us-west-2-prod-doc-source.s3.us-west-2.amazonaws.com/d90d93c1fe44bad0c8471e973ebaab339090401a95e777cffa58e977d2983b65/1534452029587-15e129dfc187505c407588df255be83de2920d733859f1d2762411d22a83e3ef?response-content-disposition=attachment%3B%20filename%2A%3DUTF-8%27%27exampleDoc29.
-
line length 591 characters (raw pass, confidence 0.50)
"ORIGINAL": "https://gb-us-west-2-prod-doc-source.s3.us-west-2.amazonaws.com/d90d93c1fe44bad0c8471e973ebaab339090401a95e777cffa58e977d2983b65/1529005196082-bb75fa19abc287699cb07147f75816dce43a53a10f28dc001bf61ef2fab01c59?response-content-disposition=attachment%3B%20filename%2A%3DUTF-8%27%27exampleDoc29.
-
line length 581 characters (raw pass, confidence 0.50)
"ORIGINAL": "https://gb-us-west-2-prod-doc-source.s3.us-west-2.amazonaws.com/15df51e0335cfcc6a2e4de9dd8be9f22ee40545ad9176f54758dcf903be982d3/1521672507741-9f7df0ea5dd0b121c4f3564a0c7c0b4da95cd12c635d3c442af337a88e297920?response-content-disposition=attachment%3B%20filename%2A%3DUTF-8%27%27exampleDoc&X-Amz-
-
line length 547 characters (raw pass, confidence 0.50)
"UploadUrl": "https://gb-us-west-2-prod-doc-source.s3.us-west-2.amazonaws.com/feaba64d4efdf271c2521b60a2a44a8f057e84beaabbe22f01267313209835f2/1536773972914-ddb67663e782e7ce8455ebc962217cf9f9e47b5a9a702e5c84dcccd417da9313?X-Amz-Algorithm=AWS1-ABCD-EFG234&X-Amz-Date=20180912T173932Z&X-Amz-SignedHeaders=conte
-
line length 578 characters (raw pass, confidence 0.50)
--trace-segment-documents "{\"id\":\"20312a0e2b8809f4\",\"name\":\"DynamoDB\",\"trace_id\":\"1-5832862d-a43aafded3334a971fe312db\",\"start_time\":1.479706157195E9,\"end_time\":1.479706157202E9,\"parent_id\":\"79736b962fe3239e\",\"http\":{\"response\":{\"content_length\":60,\"status\":200}},\"inferred\":true,\"a
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
if '.' not in path:
plugins.append(__import__(path))
else:
package, module = path.rsplit('.', 1)
likely benign
LLM, confidence 0.80
A plugin loader that imports configured plugin modules by path in the AWS CLI.
Reasoning
This is the AWS CLI plugin loader. It imports modules named by configured plugin paths using __import__, which is the documented extension mechanism. The non-literal argument is expected here, and the code has no decoding, network or shell behaviour. The critical severity reflects a generic dynamic-import rule, not malicious intent.
-
`__import__` called on a non-literal expression (ast pass, confidence 0.70)
package, module = path.rsplit('.', 1)
module = __import__(path, fromlist=[module])
plugins.append(module)
return plugins
likely benign
LLM, confidence 0.80
A dotted-path plugin import in the AWS CLI plugin loader.
Reasoning
This is the second branch of the same AWS CLI plugin loader. It imports a dotted plugin module with fromlist, which is standard for loading a named plugin from a package. It is a legitimate extension mechanism, not obfuscated execution.
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.