Threat reportThreat IntelligenceTL-2026-4688
Scanners impersonating AI crawlers (ClaudeBot, GPTBot, Googlebot, Perplexity, Amazon) hunt for exposed credentials and .env files
Scanners impersonating AI crawlers (ClaudeBot, GPTBot (TL-2026-4688), also tracked as AI crawler impersonation credential scanning, is a medium-severity tracked intrusion set, first published 2026-10-29. It has no confirmed attribution, affects Various Internet-facing web servers exposing .env, .aws/credentials or, maps to 8 MITRE ATT&CK techniques (T1036.005, T1190, T1552.001), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-4688
- Threat ID
- TL-2026-4688
- Also known as
- AI crawler impersonation credential scanning, Forged AI bot .env scanning
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, web hosting, cloud-hosted web applications, software development, ecommerce
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Scanners impersonating AI crawlers (ClaudeBot, GPTBot
Malware and tooling: ClaudeBot, GPTBot, Google-Extended, PerplexityBot
How Scanners impersonating AI crawlers (ClaudeBot, GPTBot works
GreyNoise reports 824 IP addresses across 795 /24 networks forging AI-crawler user agents to request /.env, /.aws/credentials and similar secret-bearing files between July 28 and August 23, 2026. None of the addresses fall inside the crawler operators' published IP ranges, and GreyNoise does not attribute the activity. Fastly later observed a larger related wave (about 6.3 million requests from roughly 10,200 IPs on 2026-09-23).
GreyNoise observed a single HTTP client fingerprint rotating more than 1,500 user-agent strings over 90 days. Within the July 28 - August 23, 2026 window, six forged crawler names (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended and Perplexity names, plus two Amazon crawler names reported in the Help Net Security coverage) arrived from the same 824 IP addresses in near-identical volume (within 0.2% of each other). The addresses are spread across 795 separate /24 networks, and none match the published IP ranges of Anthropic, OpenAI, Google, Perplexity or Amazon. Traffic peaked on August 23, 2026. Google-Extended alone accounted for 263,849 forged sessions, although Google-Extended is a robots.txt control token and not a real crawler user agent. GreyNoise's research was published on 2026-08-28 and covered by Help Net Security on 2026-08-31.
The scanners requested files that should never be reachable over HTTP: /.env, /app/.env, /api/.env, /backend/.env, /.env.local, /.env.production, /.env.old, /.env.bak, /.env.swp, /.aws/credentials and /.git/config, aimed at cloud access keys, private keys and password stores. Behavioral tells separate the impostors from real crawlers: none of the six forged names ever requested /robots.txt, whereas the genuine Anthropic ClaudeBot requested it in about 12% of its traffic and never asked for credential files. The forged ClaudeBot string matches Anthropic's own character for character, so user-agent rules cannot separate them. The HTTP client fingerprint (JA4H prefix ge11nn05enus_f3bb7a, published partly redacted) differs from the real Anthropic fingerprint (ge11nn080000_757a95). GreyNoise published all 824 IPs alongside the vendor IP lists so site owners can verify.
A related, larger wave was reported by Fastly on 2026-10-13 for a single 24-hour period (2026-09-23 UTC): about 6.3 million requests from roughly 10,200 IPs claiming OpenAI, Anthropic, Perplexity, DuckDuckGo and Common Crawl identities, about 60 user-agent strings across roughly a dozen identities, and a shared 96-entry wordlist covering about 3,000 distinct private files in over 46,000 path variants. About 1,600 addresses on one cloud provider generated 94% of that traffic. Variants included path traversal (/../../../../.env) and Vite dev-server probing (/@fs/.env). Whether the GreyNoise and Fastly activity share an operator has not been established by the sources, and the hunt skeleton notes GreyNoise itself cannot confirm who is behind the activity. An independent site operator (Relevant Audience, 24 hours ending 2026-08-07) also logged 1,028 credential-path requests across about 100 paths, including /.ssh/known_hosts, /.boto, /.mcp.json and /.continue/config.json, all answered with 404.
Impact is limited to sites that actually expose secret files; no confirmed compromise is reported. Exposed cloud keys or .env secrets harvested this way would enable follow-on cloud account access, so any file that was reachable should be treated as compromised and rotated.
MITRE ATT&CK techniques used in TL-2026-4688
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server
Reconnaissance
T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning; T1595.003 Active Scanning: Wordlist Scanning
Affected products and versions in Scanners impersonating AI crawlers (ClaudeBot, GPTBot
- Various — Internet-facing web servers exposing .env, .aws/credentials or .git/config files
Vulnerable versions: Any deployment that serves dotfiles or secrets from the web root - Vite — Vite dev server (probed via /@fs/.env)
Vulnerable versions: Releases earlier than 6.2.3, 6.1.2, 6.0.12, 5.4.15, 4.5.10 when the dev server is exposed
Fixed in: 6.2.3; 6.1.2; 6.0.12; 5.4.15; 4.5.10
Remediation for Scanners impersonating AI crawlers (ClaudeBot, GPTBot
Patches
- If Vite dev servers are internet-exposed, update to patched releases 6.2.3, 6.1.2, 6.0.12, 5.4.15 or 4.5.10 (per ppc.land coverage of the /@fs/.env probing)
Immediate actions
- Verify the source IP of any request claiming to be an AI crawler against the operator's published IP ranges (OpenAI gptbot.json/searchbot.json/chatgpt-user.json, Anthropic bots.json, Perplexity perplexitybot.json/perplexity-user.json, DuckDuckGo duckduckbot.json, Common Crawl ccbot.json) or by forward-confirmed reverse DNS; do not trust the User-Agent header alone
- Alert on and block requests for /.env*, /.aws/credentials, /.git/config, /.boto, /.ssh/* and similar secret paths from any client
- Rotate any cloud access keys, API tokens or secrets that were ever reachable at those paths
- Compare site logs against the 824 IPs published by GreyNoise
Workarounds
- Return 403/404 for dotfile paths at the web server or CDN layer
- Never expose development servers directly to the internet
Longer-term hardening
- Keep .env files, credentials and VCS metadata outside the web root and out of deployed artifacts
- Flag crawlers that never request /robots.txt across multiple days as suspect
- Adopt cryptographic bot verification such as Web Bot Auth (HTTP Message Signatures, RFC 9421) where operators support it
- Use WAF rules that block unverified bot claims accessing sensitive files (Fastly publishes such a rule)
Weaknesses (CWE) in Scanners impersonating AI crawlers (ClaudeBot, GPTBot
Timeline of Scanners impersonating AI crawlers (ClaudeBot, GPTBot
- Start of the GreyNoise measurement window for forged AI-crawler scanning from 824 IPs
- A site operator's 24-hour logs (ending this date) record 1,028 credential-path requests across about 100 paths from crawler-labelled clients
- Relevant Audience publishes analysis of crawler-labelled credential scanning in server logs
- Peak traffic day and end of the GreyNoise measurement window
- GreyNoise publishes findings: 824 IPs across 795 /24 networks, none inside published crawler ranges, and releases the IP list
- Help Net Security reports the GreyNoise research
- Fastly records about 6.3 million requests from roughly 10,200 IPs posing as AI bots in a 24-hour period
- Fastly publishes 'AI bot cosplay' with a WAF rule for unverified bot claims reaching sensitive files
Sources cited for Scanners impersonating AI crawlers (ClaudeBot, GPTBot
- Threat actors are posing as AI crawlers to hunt for exposed credentials (Help Net Security)
- Threat actors posing as AI crawlers (GreyNoise)
- AI bot cosplay (Fastly)
- Scanners posing as ClaudeBot hunt credential files from 824 addresses (PPC Land)
- AI crawler impostors, .env probing and IP verification (Ipregistry)
- The biggest AI crawler on one site was scanning for credentials, not reading content (Relevant Audience)
Detection coverage for TL-2026-4688
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4688 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.