Tencent Cloud COS

0 indexed

Tencent Cloud Object Storage (COS) hosts buckets at `<bucket>-<appid>.cos.<region>.myqcloud.com`. The `public-read` ACL preset is the dominant source of exposure, with the same enumeration surface as S3.

Tencent Cloud COS exposure data

Total tracked

Currently open

The trend chart appears once at least 7 days of history accrue.

Aggregate figures only. See the full open-buckets data across all providers.

Common misconfiguration class

COS bucket names embed the tenant AppID, so a discovered bucket leaks the operator's account identifier, which is useful for follow-on social-engineering or invoice-fraud attempts.

Real-world impact

Public-read ACL grants enumeration via `?list-type=2` and unauthenticated object download.

Remediation

Change bucket ACL to `private` and use STS temporary credentials.
Use a CDN domain in front of the bucket for distribution rather than direct COS endpoints.

URL patterns

Tencent Cloud COS buckets typically resolve under hostnames like:

example-1234567890.cos.ap-guangzhou.myqcloud.com

Check a specific Tencent Cloud COS URL

Paste any Tencent Cloud COS URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.

Open the Viewer

Own a listed Tencent Cloud COS bucket?

If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.

Submit takedown request