GreyNoise identified six forged AI crawler names sending traffic from the same 824 addresses in near-identical volume, part of a wider cluster impersonating 13 crawler names from eight companies to request .env files, cloud access keys, private keys and password stores. The six belong to four companies: Anthropic, OpenAI, Google and Perplexity. DeepSeek shows up in the report’s title and in the wider set of 13 names, not among the six.
Six Forged AI Crawler Names, Four Real Companies
The same cluster forged two of Amazon’s crawler names too, in even greater volume, and neither string matches the user agent Amazon documents. GreyNoise’s own explanation of why a name alone can’t catch this: the impostors’ ClaudeBot string “matches Anthropic’s character for character, so no rule keyed on the user agent can tell the two apart.”
What Makes an AI Crawler Name Forged?
A forged name is one the sender simply typed. Between 28 July 2026 and 23 August 2026, the six matched names sent traffic from 824 addresses, and GreyNoise checked every one of those addresses against the ranges Anthropic, OpenAI, Google and Perplexity publish, without a single match. Real ClaudeBot sessions, measured the same way over the same window, did arrive from Anthropic’s published addresses.
The forged sessions went after the same short list of paths, most requested in this order:
- /.env
- /app/.env
- /api/.env
- /backend/.env
- /.env.local
- /.env.production
- /.env.old
- /.env.bak
- /.aws/credentials
- /.env.swp
GreyNoise’s write-up also names /.git/config among the targeted paths.
Google-Extended Isn’t a Crawler Identity
Google-Extended is the token publishers write into robots.txt to opt their content out of Gemini training. Google’s own documentation is direct about it: “Google-Extended doesn’t have a separate HTTP request user agent string. Crawling is done with existing Google user agent strings; the robots.txt user-agent token is used in a control capacity.” No Google crawler sends it.
GreyNoise still counted 263,849 sessions carrying Google-Extended as a user agent over the same window as the six matched names, and concluded every one was forged. Our own reading: a Google-Extended row in a log analyzer or an “AI traffic” dashboard is a free test of that tool’s own bot classification, because on Google’s documentation no legitimate visit can produce one.
Behavior the Name Can’t Fake
A real crawler reads /robots.txt first, the file where a site states its rules. Under all six forged names, across the full window, that file was never requested once. Anthropic’s real crawler, measured the same way, requested /robots.txt more than any other path, 12% of its traffic, and never once asked for a credential file. Almost every forged session still carried the same Web Crawler label that legitimate crawler traffic carries, so a label doesn’t separate the two either.
Network blocking fails at the scale GreyNoise measured: the 824 addresses spread across 795 separate /24 networks. GreyNoise used JA4/JA4H HTTP client fingerprinting, a method it says “identifies the software making the requests, not the machine running it,” to trace the pattern. Over the wider 90 days to 23 August 2026, that same fingerprint carried more than 1,500 distinct user agent strings, most of them ordinary browsers. Its recommendations do not stop at the name: “Check the connecting address against the published list for the name it claims,” and “Allow only when the fingerprint and a published address agree.”
“GreyNoise observes requests arriving. Nothing here says a file was returned or that any organization was affected, and we are not naming who is behind it.”
— GreyNoise, 28 August 2026
Declaration Isn’t Authentication
A robots.txt file, like the one our own robots.txt generator produces, states rules for agents that choose to read the file and name themselves honestly. It has never verified who is actually asking.
That distinction came up here before. When Cloudflare shipped Bot Preference Sync, a tool that writes an operator’s dashboard settings into that same file, we set out the difference between two of the dashboard settings it publishes: a Block closes the door at Cloudflare’s network edge, while a Disallow only writes a request into a text file that a crawler can choose to honor. A name in a text file and a block applied at the network edge are two different layers. Forging a name defeats a rule keyed on the name, and a robots.txt group is exactly that.
Source: GreyNoise, “Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets”; Google Search Central, Google crawlers and fetchers