# Scanners impersonating AI crawlers (ClaudeBot, GPTBot, Googlebot, Perplexity, Amazon) hunt for exposed credentials and .env files

> GreyNoise reports 824 IP addresses across 795 /24 networks forging AI-crawler user agents to request /.env, /.aws/credentials and similar secret-bearing files between July 28 and August 23, 2026. None of the addresses fall inside the crawler operators' published IP ranges, and GreyNoise does not attribute the activity. Fastly later observed a larger related wave (about 6.3 million requests from roughly 10,200 IPs on 2026-09-23).

- **Published:** 2026-10-29T00:34:54Z
- **Last reviewed:** 2026-10-29T00:34:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4688
- **ID:** TL-2026-4688
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GreyNoise observed a single HTTP client fingerprint rotating more than 1,500 user-agent strings over 90 days. Within the July 28 - August 23, 2026 window, six forged crawler names (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended and Perplexity names, plus two Amazon crawler names reported in the Help Net Security coverage) arrived from the same 824 IP addresses in near-identical volume (within 0.2% of each other). The addresses are spread across 795 separate /24 networks, and none match the published IP ranges of Anthropic, OpenAI, Google, Perplexity or Amazon. Traffic peaked on August 23, 2026. Google-Extended alone accounted for 263,849 forged sessions, although Google-Extended is a robots.txt control token and not a real crawler user agent. GreyNoise's research was published on 2026-08-28 and covered by Help Net Security on 2026-08-31.

The scanners requested files that should never be reachable over HTTP: /.env, /app/.env, /api/.env, /backend/.env, /.env.local, /.env.production, /.env.old, /.env.bak, /.env.swp, /.aws/credentials and /.git/config, aimed at cloud access keys, private keys and password stores. Behavioral tells separate the impostors from real crawlers: none of the six forged names ever requested /robots.txt, whereas the genuine Anthropic ClaudeBot requested it in about 12% of its traffic and never asked for credential files. The forged ClaudeBot string matches Anthropic's own character for character, so user-agent rules cannot separate them. The HTTP client fingerprint (JA4H prefix ge11nn05enus_f3bb7a, published partly redacted) differs from the real Anthropic fingerprint (ge11nn080000_757a95). GreyNoise published all 824 IPs alongside the vendor IP lists so site owners can verify.

A related, larger wave was reported by Fastly on 2026-10-13 for a single 24-hour period (2026-09-23 UTC): about 6.3 million requests from roughly 10,200 IPs claiming OpenAI, Anthropic, Perplexity, DuckDuckGo and Common Crawl identities, about 60 user-agent strings across roughly a dozen identities, and a shared 96-entry wordlist covering about 3,000 distinct private files in over 46,000 path variants. About 1,600 addresses on one cloud provider generated 94% of that traffic. Variants included path traversal (/../../../../.env) and Vite dev-server probing (/@fs/.env). Whether the GreyNoise and Fastly activity share an operator has not been established by the sources, and the hunt skeleton notes GreyNoise itself cannot confirm who is behind the activity. An independent site operator (Relevant Audience, 24 hours ending 2026-08-07) also logged 1,028 credential-path requests across about 100 paths, including /.ssh/known_hosts, /.boto, /.mcp.json and /.continue/config.json, all answered with 404.

Impact is limited to sites that actually expose secret files; no confirmed compromise is reported. Exposed cloud keys or .env secrets harvested this way would enable follow-on cloud account access, so any file that was reachable should be treated as compromised and rotated.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1595.003 Active Scanning: Wordlist Scanning
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1190 Exploit Public-Facing Application
- T1583.003 Acquire Infrastructure: Virtual Private Server

## Sources

- [Threat actors are posing as AI crawlers to hunt for exposed credentials (Help Net Security)](https://www.helpnetsecurity.com/2026/08/31/ai-crawlers-scan-exposed-credentials/)
- [Threat actors posing as AI crawlers (GreyNoise)](https://www.greynoise.io/blog/threat-actors-posing-as-ai-crawlers)
- [AI bot cosplay (Fastly)](https://www.fastly.com/blog/ai-bot-cosplay)
- [Scanners posing as ClaudeBot hunt credential files from 824 addresses (PPC Land)](https://ppc.land/scanners-posing-as-claudebot-hunt-credential-files-from-824-addresses/)
- [AI crawler impostors, .env probing and IP verification (Ipregistry)](https://ipregistry.co/blog/ai-crawler-impostors-env-probing-ip-verification)
- [The biggest AI crawler on one site was scanning for credentials, not reading content (Relevant Audience)](https://www.relevantaudience.com/seo/ai-crawler-credential-scanning-server-logs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4688