Threat actors are impersonating AI web crawlers from organizations such as OpenAI, Anthropic, DeepSeek, Google, Perplexity, and Amazon to scan internet-facing servers for exposed secrets, according to a GreyNoise research report published on August 28, 2026.
This activity involves automated scanners that use forged crawler user-agent strings to request sensitive files, including .env configurations, AWS credential stores, private keys, and Git configuration files. This campaign illustrates how organizations that rely solely on crawler names can inadvertently allow malicious reconnaissance activity to bypass access controls.
GreyNoise identified a cluster that impersonated 13 AI crawler identities across eight companies. Notably, six forged AI crawler names associated with Anthropic, OpenAI, Google, and Perplexity exhibited similar traffic volumes. They originated from 824 IP addresses spanning 795 separate /24 networks and shared a single HTTP client fingerprint.
Fake Crawler Campaign
A user-agent string is self-reported by the client. It provides no proof that a request originated from the organization named in the header. This enables attackers to replicate legitimate crawler identifiers, such as Anthropic’s ClaudeBot string, character-for-character.
Between July 28 and August 23, 2026, the impersonated crawlers used the same HTTP client fingerprint while rotating through more than 1,500 user-agent strings over 90 days. Although most of these strings identified as standard web browsers, the malicious infrastructure also adopted AI crawler identities.
One notable example was “Google-Extended,” a token that publishers can add to the robots.txt file to control Google’s use of AI training data. Google states that “Google-Extended” does not have a separate HTTP request user-agent string, and GreyNoise observed 263,849 sessions claiming to be Google-Extended, meaning each of those requests was forged.
The scanner cluster also impersonated Amazon crawler names at a higher volume. However, GreyNoise found that the observed Amazon user-agent strings did not match those documented by Amazon.
Legitimate search and AI crawlers typically retrieve publicly accessible page content and check the robots.txt file to determine crawling rules. In contrast, the six impersonated AI crawler identities did not request the /robots.txt file in any observed traffic.
Instead, they probed for files that often contain high-value secrets. Across the traffic associated with the shared fingerprint, GreyNoise recorded millions of requests for environment files, cloud access keys, private keys, and password stores.
This behavior sharply contrasts with Anthropic’s legitimate crawler activity. During the same observation period, GreyNoise found that /robots.txt was ClaudeBot’s most-requested path, accounting for 12% of its traffic. The legitimate crawler did not request credential files.
GreyNoise also checked all observed source addresses against the published IP ranges for OpenAI, Anthropic, Google, Perplexity, and Amazon crawlers. None of the 824 IP addresses used by the impersonation cluster matched any published legitimate crawler range.
The company emphasizes that while its telemetry confirms malicious requests were sent, it does not indicate that target files were successfully accessed or that a specific victim organization was compromised.
IoC
| Indicator Type | Indicator / Value | Security Relevance |
|---|---|---|
| Campaign period | July 28–August 23, 2026 | Major impersonation activity occurred primarily in August |
| Source infrastructure | 824 IP addresses across 795 /24 networks | Broadly distributed infrastructure limits network-based blocking |
| Impostor JA4H fingerprint | ge11nn05enus_f3bb7a... | Use for investigation and correlation; GreyNoise advises against blocking on this alone |
| Real ClaudeBot JA4H | ge11nn080000_757a95... | Pair only with Anthropic-published source ranges |
| Legitimate Anthropic range example | 216.73.216.0/22 | Verify current ownership against Anthropic’s published list |
| Sensitive path | /.env | May expose API tokens, database passwords and cloud keys |
| Sensitive path | /app/.env | Application environment configuration target |
| Sensitive path | /api/.env | API service secrets target |
| Sensitive path | /backend/.env | Backend credential discovery target |
| Sensitive path | /.env.local | Local deployment secrets target |
| Sensitive path | /.env.production | Production environment secrets target |
| Sensitive path | /.env.bak | Backup configuration file target |
| Sensitive path | /.aws/credentials | AWS access-key and secret-key target |
| Sensitive path | /.git/config | Repository metadata and potentially exposed remote URLs |
| Related vulnerability | CVE-2025-30208 | Vite arbitrary file disclosure scanning activity was associated with the campaign |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Security teams should treat any requests for /.env, /.aws/credentials, /.git/config, private key files, or password stores as suspicious unless they originate from an explicitly authorized scanner. Organizations should also monitor for crawler-labeled requests that do not demonstrate expected robots.txt behavior over time.
Web administrators should remove .env, .git, and cloud credential files from web-accessible directories. Any cloud key that may have been exposed via a publicly accessible web path should be rotated immediately.
Finally, access control rules must validate the connecting IP address against the specific vendor’s published crawler range. A claimed user agent, such as ClaudeBot, GPTBot, or PerplexityBot, alone is not a reliable identity signal. It should never be allowed to bypass security controls.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
