{"slug": "threat-actors-are-posing-as-openai-anthropic-and-deepseek-to-target-credentials", "title": "Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets", "summary": "GreyNoise reported that automated scanners forged the web crawler identities of OpenAI, Anthropic, DeepSeek, Google and Perplexity to request credentials and secrets, with six forged AI crawler names arriving from 824 separate addresses between July 28 and August 23, 2026. The forged traffic never requested /robots.txt and instead sought .env files, cloud access keys, private keys and password stores, and none of the requests originated from the crawlers' published address ranges. Anthropic's real crawler, measured over the same window, requested /robots.txt more than any other path at 12% of its traffic and never requested a credential file.", "body_md": "GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. These forged automated scanners have been observed requesting files often exposed on misconfigured web servers and by other commonly leaked secret and credential methods.\n\nA cluster of scanners impersonating 13 AI crawlers from eight companies requested `.env` files, cloud access keys, private keys and password stores. Six of those names came from the same 824 addresses in almost identical volume, and within this cluster none of the six requested `/robots.txt.`\n\nAn `.env` file is where an application keeps database passwords, cloud access keys, API tokens, and other secrets.\n\n## Why This Matters\n\nEvery program that visits a website announces itself in one line of the request. Chrome says it is Chrome. Googlebot says it is Googlebot. Anthropic's crawler says it is ClaudeBot. Nothing in the request itself *proves* any of it is true.\n\nAI companies publish crawler names so site owners can allow their crawlers, and address lists so they can verify them. The user agent is a client-supplied header, so a control that checks the name but not the address can be bypassed by forging it.\n\nThreat actors are impersonating AI companies while requesting credentials and secrets. Their ClaudeBot string matches Anthropic's character for character, so no rule keyed on the user agent can tell the two apart. They also forged two of Amazon's crawler names, in even greater volume. Neither matches the user agent Amazon documents.\n\n## Key Takeaways\n\n- **Six AI crawler names arrived in matched volume.** They belong to Anthropic, OpenAI, Google and Perplexity.\n- **The six forged names never requested /robots.txt in this traffic.** A real crawler reads that file first to learn a site's rules. Anthropic's real crawler requested it more often than any other path.\n- **The requests targeted credentials and secrets.** They requested environment files, cloud keys, private keys and password stores.\n- **None of the traffic came from the real crawlers' published addresses.** All four companies publish the address ranges their crawlers use. We checked every address against every one of those lists. Not one matched.\n\n## The Six Forged AI Crawler Names\n\nBetween July 28 and August 23, 2026, six AI crawler names belonging to four companies arrived on a single HTTP client fingerprint. Across the 90 days to August 23, that same fingerprint carried more than 1,500 different user agent strings, most of them ordinary browsers.\n\nAlmost all of the six-name traffic arrived in August. The largest single day was 23 August.\n\nThat fingerprint identifies the software making the requests, not the machine running it. The six names arrived from 824 separate addresses.\n\nGoogle-Extended is a word publishers write in robots.txt to opt out of AI training. Google documents that it \"doesn't have a separate HTTP request user agent string.\" No Google crawler sends it. So all 263,849 sessions carrying it here were forged.\n\n## Request Behavior\n\nA real crawler reads `/robots.txt` first, the file where a site states its rules. Under the six forged names, that file was never requested once.\n\nWhat they asked for instead was credentials. Across all traffic on this one fingerprint, which carried other names besides the six, requests for environment files, cloud access keys, private keys and password stores ran into the millions.\n\n**Anthropic's real crawler, measured over the same window by the same method, does the opposite.** `/robots.txt` was the single path it requested most, 12% of its traffic, and it never requested a credential file.\n\n## How We Know These Are Not the Real Crawlers\n\nNo legitimate AI crawler asks for credentials. These crawlers exist to read pages so an assistant can cite them, and a `.env` file is not a page. Anthropic's real crawler, measured the same way over the same window, never requested one.\n\nAll four companies publish the address ranges their crawlers use. We fetched every one of those lists, and Amazon's as well, and checked every address that sent a forged name against all of them. Not one matched. Over the same window, thousands of sessions carrying the ClaudeBot name did arrive from Anthropic's published addresses.\n\nThe label does not separate them. Almost every session here carries the same Web Crawler label that real crawler traffic carries. It’s also not possible to do network-based blocking, because the 824 addresses are spread across 795 separate /24 networks. The published lists do separate them, since not one of the 824 falls inside any range these four companies publish.\n\nGreyNoise observes requests arriving. Nothing here says a file was returned or that any organization was affected, and we are not naming who is behind it.\n\n## Recommendations\n\nIdentify this activity using more than the user agent. The 824 addresses sit in 795 separate /24 networks, so there is no single network to block. Wherever a crawler name already grants access or waives a control, check the connecting address against the published list for the name it claims.\n\n### For Security Operations\n\n- Never treat a user agent string as identity. Check the connecting address against the published list for the name it claims\n- Alert on any request for `/.env` , `/.aws/credentials` or `/.git/config` . No crawler has any reason to ask for these, and your own scanners should already be on a known list\n- A crawler that never requests `/robots.txt` is not behaving like a crawler. Real crawlers cache that file, so judge this across days instead of single visits\n\n### For Security Leadership\n\n- Find every place a user agent string grants access or waives a control, and put a real check behind it\n- Give each vendor address list an owner and a refetch schedule. A stale list turns the real crawler into an alert\n\n### For Web and Platform Administrators\n\n- Keep `.env` , `.git` and cloud credential files out of the web root entirely\n- Rotate any cloud key that was ever reachable from a web path, and assume anything readable was read\n- Upgrade Vite to 6.2.3, 6.1.2, 6.0.12, 5.4.15 or 4.5.10\n\n## Indicators of Attack\n\nThe full list of 824 addresses can be found [here](https://github.com/GreyNoise-Intelligence/gn-research-supplemental-data/blob/main/2026-08-27-forged-ai-crawlers/ips.csv).\n\nGreyNoise customers get the complete indicator set by email. That includes the above IPs, every credential path observed, the fingerprint families, and complete JA4+ fingerprints.\n\n**The published crawler address lists, so the check in this post can be repeated.** Every address that sent a forged name was tested against all of these.\n\n- `https://claude.com/crawling/bots.json`\n- `https://openai.com/gptbot.json`\n- `https://openai.com/chatgpt-user.json`\n- `https://openai.com/searchbot.json`\n- `https://developers.google.com/static/crawling/ipranges/common-crawlers.json`\n- `https://developers.google.com/static/crawling/ipranges/special-crawlers.json`\n- `https://developers.google.com/static/crawling/ipranges/user-triggered-fetchers.json`\n- `https://www.perplexity.ai/perplexitybot.json`\n- `https://www.perplexity.ai/perplexity-user.json`\n- `https://developer.amazon.com/amazonbot/ip-addresses/`\n- `https://developer.amazon.com/amazonbot/searchbot-ip-addresses/`\n\n****\n\n**Impostor client fingerprint (JA4H): We recommend using this for investigation rather than blocking.** The fingerprint is half-redacted here; the complete value is available in the [Visualizer](https://viz.greynoise.io/observe/explore) and in the customer package.\n\n`ge11nn05enus_f3bb7a...`\n\n**Most requested impostor credential paths:**\n\n`/.env`             \n\n`/app/.env`  \n\n`/api/.env`  \n\n`/backend/.env`      \n\n`/.env.local`\n\n`/.env.production`  \n\n`/.env.old`  \n\n`/.env.bak`  \n\n`/.aws/credentials`  \n\n`/.env.swp`\n\n****\n\n### Do Not Alert On These\n\nThese belong to Anthropic's real crawler. Do not block or alert on them, and do not import them as indicators.\n\n**REAL FINGERPRINT, PAIR WITH A PUBLISHED ADDRESS**\n\n`ge11nn080000_757a95...`    \n\n****\n\n**REAL STRING, SENT BY BOTH**\n\n`Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)`    \n\n****\n\n**VERIFY AGAINST THE PUBLISHED RANGE**\n\n`216.73.216.0/22`    \n\n****\n\nThe user agent string proves nothing on its own, because the real crawler and the impostor both send it. The fingerprint is not enough on its own either. Allow only when the fingerprint and a published address agree.\n\nEach crawler name has its own list. OpenAI publishes separate lists for GPTBot, ChatGPT-User and OAI-SearchBot, so check the name you actually saw against that name's list. All the lists are in the customer package.\n\n*Associated GreyNoise tags:*\n\n[Read the full report](#)", "url": "https://wpnews.pro/news/threat-actors-are-posing-as-openai-anthropic-and-deepseek-to-target-credentials", "canonical_source": "https://www.greynoise.io/blog/threat-actors-posing-as-ai-crawlers", "published_at": "2026-08-28 00:00:00+00:00", "updated_at": "2026-09-14 15:19:46.411297+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "artificial-intelligence"], "entities": ["GreyNoise", "OpenAI", "Anthropic", "DeepSeek", "Google", "Perplexity", "ClaudeBot", "Google-Extended"], "alternates": {"html": "https://wpnews.pro/news/threat-actors-are-posing-as-openai-anthropic-and-deepseek-to-target-credentials", "markdown": "https://wpnews.pro/news/threat-actors-are-posing-as-openai-anthropic-and-deepseek-to-target-credentials.md", "text": "https://wpnews.pro/news/threat-actors-are-posing-as-openai-anthropic-and-deepseek-to-target-credentials.txt", "jsonld": "https://wpnews.pro/news/threat-actors-are-posing-as-openai-anthropic-and-deepseek-to-target-credentials.jsonld"}}