GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. These forged automated scanners have been observed requesting files often exposed on misconfigured web servers and by other commonly leaked secret and credential methods.
A cluster of scanners impersonating 13 AI crawlers from eight companies requested .env
files, cloud access keys, private keys and password stores. Six of those names came from the same 824 addresses in almost identical volume, and within this cluster none of the six requested /robots.txt.
An .env
file is where an application keeps database passwords, cloud access keys, API tokens, and other secrets.
Why This Matters
Every program that visits a website announces itself in one line of the request. Chrome says it is Chrome. Googlebot says it is Googlebot. Anthropic's crawler says it is ClaudeBot. Nothing in the request itself proves any of it is true.
AI companies publish crawler names so site owners can allow their crawlers, and address lists so they can verify them. The user agent is a client-supplied header, so a control that checks the name but not the address can be bypassed by forging it.
Threat actors are impersonating AI companies while requesting credentials and secrets. Their ClaudeBot string matches Anthropic's character for character, so no rule keyed on the user agent can tell the two apart. They also forged two of Amazon's crawler names, in even greater volume. Neither matches the user agent Amazon documents.
Key Takeaways
- Six AI crawler names arrived in matched volume. They belong to Anthropic, OpenAI, Google and Perplexity.
- The six forged names never requested /robots.txt in this traffic. A real crawler reads that file first to learn a site's rules. Anthropic's real crawler requested it more often than any other path.
- The requests targeted credentials and secrets. They requested environment files, cloud keys, private keys and password stores.
- None of the traffic came from the real crawlers' published addresses. All four companies publish the address ranges their crawlers use. We checked every address against every one of those lists. Not one matched.
The Six Forged AI Crawler Names
Between July 28 and August 23, 2026, six AI crawler names belonging to four companies arrived on a single HTTP client fingerprint. Across the 90 days to August 23, that same fingerprint carried more than 1,500 different user agent strings, most of them ordinary browsers.
Almost all of the six-name traffic arrived in August. The largest single day was 23 August.
That fingerprint identifies the software making the requests, not the machine running it. The six names arrived from 824 separate addresses.
Google-Extended is a word publishers write in robots.txt to opt out of AI training. Google documents that it "doesn't have a separate HTTP request user agent string." No Google crawler sends it. So all 263,849 sessions carrying it here were forged.
Request Behavior
A real crawler reads /robots.txt
first, the file where a site states its rules. Under the six forged names, that file was never requested once.
What they asked for instead was credentials. Across all traffic on this one fingerprint, which carried other names besides the six, requests for environment files, cloud access keys, private keys and password stores ran into the millions.
Anthropic's real crawler, measured over the same window by the same method, does the opposite. /robots.txt
was the single path it requested most, 12% of its traffic, and it never requested a credential file.
How We Know These Are Not the Real Crawlers
No legitimate AI crawler asks for credentials. These crawlers exist to read pages so an assistant can cite them, and a .env
file is not a page. Anthropic's real crawler, measured the same way over the same window, never requested one.
All four companies publish the address ranges their crawlers use. We fetched every one of those lists, and Amazon's as well, and checked every address that sent a forged name against all of them. Not one matched. Over the same window, thousands of sessions carrying the ClaudeBot name did arrive from Anthropic's published addresses.
The label does not separate them. Almost every session here carries the same Web Crawler label that real crawler traffic carries. It’s also not possible to do network-based blocking, because the 824 addresses are spread across 795 separate /24 networks. The published lists do separate them, since not one of the 824 falls inside any range these four companies publish.
GreyNoise observes requests arriving. Nothing here says a file was returned or that any organization was affected, and we are not naming who is behind it.
Recommendations
Identify this activity using more than the user agent. The 824 addresses sit in 795 separate /24 networks, so there is no single network to block. Wherever a crawler name already grants access or waives a control, check the connecting address against the published list for the name it claims.
For Security Operations
- Never treat a user agent string as identity. Check the connecting address against the published list for the name it claims
- Alert on any request for
/.env
,/.aws/credentials
or/.git/config
. No crawler has any reason to ask for these, and your own scanners should already be on a known list - A crawler that never requests
/robots.txt
is not behaving like a crawler. Real crawlers cache that file, so judge this across days instead of single visits
For Security Leadership
- Find every place a user agent string grants access or waives a control, and put a real check behind it
- Give each vendor address list an owner and a refetch schedule. A stale list turns the real crawler into an alert
For Web and Platform Administrators
- Keep
.env
,.git
and cloud credential files out of the web root entirely - Rotate any cloud key that was ever reachable from a web path, and assume anything readable was read
- Upgrade Vite to 6.2.3, 6.1.2, 6.0.12, 5.4.15 or 4.5.10
Indicators of Attack
The full list of 824 addresses can be found here.
GreyNoise customers get the complete indicator set by email. That includes the above IPs, every credential path observed, the fingerprint families, and complete JA4+ fingerprints.
The published crawler address lists, so the check in this post can be repeated. Every address that sent a forged name was tested against all of these.
https://claude.com/crawling/bots.json
https://openai.com/gptbot.json
https://openai.com/chatgpt-user.json
https://openai.com/searchbot.json
https://developers.google.com/static/crawling/ipranges/common-crawlers.json
https://developers.google.com/static/crawling/ipranges/special-crawlers.json
https://developers.google.com/static/crawling/ipranges/user-triggered-fetchers.json
https://www.perplexity.ai/perplexitybot.json
https://www.perplexity.ai/perplexity-user.json
https://developer.amazon.com/amazonbot/ip-addresses/
https://developer.amazon.com/amazonbot/searchbot-ip-addresses/
Impostor client fingerprint (JA4H): We recommend using this for investigation rather than blocking. The fingerprint is half-redacted here; the complete value is available in the Visualizer and in the customer package.
ge11nn05enus_f3bb7a...
Most requested impostor credential paths:
/.env
/app/.env
/api/.env
/backend/.env
/.env.local
/.env.production
/.env.old
/.env.bak
/.aws/credentials
/.env.swp
Do Not Alert On These
These belong to Anthropic's real crawler. Do not block or alert on them, and do not import them as indicators.
REAL FINGERPRINT, PAIR WITH A PUBLISHED ADDRESS
ge11nn080000_757a95...
REAL STRING, SENT BY BOTH
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
VERIFY AGAINST THE PUBLISHED RANGE
216.73.216.0/22
The user agent string proves nothing on its own, because the real crawler and the impostor both send it. The fingerprint is not enough on its own either. Allow only when the fingerprint and a published address agree.
Each crawler name has its own list. OpenAI publishes separate lists for GPTBot, ChatGPT-User and OAI-SearchBot, so check the name you actually saw against that name's list. All the lists are in the customer package.
Associated GreyNoise tags: