# Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI Crawlers to Harvest Credentials and Secrets

> GreyNoise identified 824 IP addresses across 795 /24 networks sending forged AI-crawler user-agent strings (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended, PerplexityBot) between July 28 and August 23, 2026 to probe internet-facing servers for .env files, AWS credentials, .git/config, and password stores. None of the traffic originated from the vendors' published crawler IP ranges and none of it requested /robots.txt first, the behavioral tell that separated it from genuine crawler traffic. No confirmed compromises have been reported.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-10-21T16:14:07.370Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2204
- **ID:** TL-2026-2204
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-30208

## Description

Between July 28 and August 23, 2026, GreyNoise observed a cluster of 824 addresses spread across 795 distinct /24 networks sending HTTP requests bearing six forged AI-crawler user-agent strings — ClaudeBot (Anthropic), GPTBot, ChatGPT-User, and OAI-SearchBot (OpenAI), Google-Extended (Google), and PerplexityBot (Perplexity) — along with forged Amazon crawler variants observed in higher volume. Every one of the six primary names arrived in near-identical volume behind a single shared HTTP client fingerprint, which GreyNoise used JA4+ fingerprinting to cluster and unmask as one coordinated scanning operation rather than six unrelated bots.

Two behavioral signals distinguished the traffic from legitimate crawler activity. First, none of the 824 addresses matched any address in the four companies' officially published crawler IP-range lists (Anthropic's claude.com/crawling/bots.json, OpenAI's gptbot.json/chatgpt-user.json/searchbot.json, Google's published crawling IP ranges, and Perplexity's perplexitybot.json/perplexity-user.json) — every address was checked against every list and none matched. Second, a genuine crawler requests /robots.txt before crawling; GreyNoise's own telemetry shows the real Anthropic ClaudeBot requests /robots.txt in roughly 12% of its traffic, while the forged cluster never requested it once across the full collection window. Google-Extended alone accounted for 263,849 forged sessions, notable because Google documents that Google-Extended has no separate published user-agent string to spoof in the first place.

The forged traffic specifically targeted credential- and secret-bearing paths: /.env and its common variants (/.env.local, /.env.production, /.env.old, /.env.bak, /.env.swp), /app/.env, /api/.env, /.aws/credentials, /.git/config, and local password stores. GreyNoise's supplemental dataset classifies 806 of the 824 addresses as malicious and 18 as unknown, with none classified benign, though the top-volume addresses observed (e.g., 136.110.54.83, 35.204.220.189, 136.66.71.144, 34.62.67.70, 34.125.245.56) sit in cloud-tenant (hyperscaler) address space, which GreyNoise flags for verification before blocking given how frequently such ranges are reassigned between tenants.

GreyNoise separately calls out CVE-2025-30208, a Vite dev-server arbitrary file disclosure in which appending ?raw?? or ?import&raw?? to a request bypasses the @fs access-control check, as a related exposure vector: an internet-facing Vite dev server left unpatched compounds the risk of exactly the kind of credential-file harvesting this campaign is attempting. GreyNoise is explicit that its telemetry shows only requests arriving, not outcomes — "nothing here says a file was returned or that any organization was affected" — and reports no confirmed compromises tied to this activity as of publication. No threat-actor attribution is offered.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1595.003 Active Scanning: Wordlist Scanning
- T1583.006 Acquire Infrastructure: Web Services
- T1588.006 Vulnerabilities
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1190 Exploit Public-Facing Application
- T1552.001 Unsecured Credentials: Credentials In Files
- T1555 Credentials from Password Stores
- T1005 Data from Local System
- T1552.004 Unsecured Credentials: Private Keys
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API

## Sources

- [Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets](https://www.greynoise.io/blog/threat-actors-posing-as-ai-crawlers)
- [GreyNoise Supplemental Data: 2026-08-27 Forged AI Crawlers IP List](https://github.com/GreyNoise-Intelligence/gn-research-supplemental-data/blob/main/2026-08-27-forged-ai-crawlers/ips.csv)
- [NVD CVE-2025-30208 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-30208)
- [GHSA-x574-m823-4x7w: Vite's @fs access control bypass via query string](https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w)
- [Anthropic ClaudeBot published crawler IP list](https://claude.com/crawling/bots.json)
- [OpenAI GPTBot published IP list](https://openai.com/gptbot.json)
- [OpenAI ChatGPT-User published IP list](https://openai.com/chatgpt-user.json)
- [OpenAI OAI-SearchBot published IP list](https://openai.com/searchbot.json)
- [Google crawler IP ranges](https://developers.google.com/static/crawling/ipranges/)
- [Perplexity PerplexityBot published IP list](https://www.perplexity.ai/perplexitybot.json)
- [Perplexity Perplexity-User published IP list](https://www.perplexity.ai/perplexity-user.json)
- [Amazonbot published IP addresses](https://developer.amazon.com/amazonbot/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2204