In a single day, more than six million requests impersonated AI bots and went hunting for .env files, Git metadata, credentials and other private files. Most came from one campaign on a single cloud provider, cycling through about a dozen AI bot identities against a 96-file wordlist. Here we’ll unpack our findings and share a rule that catches these impostors.
Almost every web client identifies itself with a User-Agent header. It's how browsers, search-engine crawlers, and AI bots introduce themselves to a server. To help operators spot the real AI traffic, AI vendors publish their official User-Agent strings and a way to verify them, usually their IP ranges. But the User-Agent is whatever the client says it is. Trust it without checking the source and you have a blind spot. Threat actors exploit this trust gap by impersonating well-known AI bots to bypass basic access controls and carry out nefarious activities.
Recent research from GreyNoise put a spotlight on actors doing exactly that, showing that malicious bots are posing as OpenAI, Anthropic, Google, and Perplexity to search for private files such as private keys, credentials, and API tokens. To see how this behavior plays out on our own network, we examined one full day of Fastly Next-Gen WAF traffic for customers running Bot Management. We wanted to answer: how much impostor AI traffic goes looking for private files on our customers' sites in a single day?
Most AI Bots Are Legitimate. Watch Out For Impostors
First, a note in the bots’ defense. The majority of AI bot traffic on our network is exactly what it says it is. Fastly does not take the User-Agent at its word, we check whether the connecting address actually belongs to the vendor it names, and attach a VERIFIED-BOT signal to the request when it does. The real bots pass that check and go about their business. They are not the story here.
The concern lies in traffic that adopts the identity of a verifiable AI bot yet fails verification, exposing them as impostors. Over 24 hours we saw about 6.3 million requests coming from nearly 10,200 unique IP addresses falsely claiming to be AI crawlers and AI fetchers while probing for sensitive information.
Who They Impersonate
Rather than favoring a specific AI bot, requests were distributed fairly evenly. The ten most-impersonated identities each drew around 500,000 requests in the day, spread across OpenAI, Anthropic, Perplexity, DuckDuckGo, and Common Crawl’s bots.
Most of this traffic came from one campaign. Out of approximately 10,200 identified IP addresses, roughly 1,600 were responsible for 94% of that day's impostor requests, with nearly all of that traffic originating from infrastructure hosted on a single public cloud provider. The majority of those addresses cycled through exactly a dozen AI bot identities, spreading their requests roughly evenly. They shared one wordlist of 96 file names, and the whole group used about 60 distinct User-Agent strings. Together they reached more than 100,000 sites. The other ~8,600 addresses are a long tail, including smaller campaigns but mostly single-identity addresses sending a handful of requests each.
What the Impostors Want
Mostly environment files. The campaign’s wordlist targeted 96 file names, which accounted for nearly all of its requests. Counting the long tail too, the day’s total reached about 3,000 distinct private files, across more than 46,000 path variants once you count every prefix, locale and traversal form of the same filename. Rolled up by family, the concentration on .env is hard to miss:
At the individual-path level, it is the same story: a wordlist, every permutation, sprayed across sites. The busiest single path, /.env, was probed by nearly 1,800 distinct addresses in the day. Note the traversal and dev-server flavors mixed in (/../../../../.env, /@fs/.env, the latter targeting Vite's development-server file route):
How to Stop Them
Filtering on exact User-Agent strings is brittle. However, because spoofing requires asserting a specific crawler identity (such as GPTBot, ClaudeBot, or Perplexity-User), that declared claim remains constant. When a request impersonates a known AI bot without verification while attempting to access confidential files like .env, it serves no valid function and can be blocked.
For Fastly Next-Gen WAF sites with Bot Management enabled, this can be handled using a single request rule:
Because the logic keys on the claimed identity and the verification result, this rule remains effective even if the attacker rotates IP addresses, modifies User-Agent strings, or changes other request attributes, as long as the request claims an AI bot name.
Trust the Verification, Not the Impostors
Impersonating an AI bot is trivial, and knowing how legitimate traffic differs can help you stop attackers before they reach their objectives. Impostors are hunting for exposed private files, hoping a misconfigured server will hand over API keys, database passwords, or access tokens. They borrow the names of well-known AI bots because some sites treat them with more leniency, allow listing them outright or applying looser rate limits, and a familiar User-Agent string can slip past defenses that would flag an unknown scanner. Verifying where that traffic actually comes from rather than what it claims to be takes away that advantage.
It's worth taking a closer look at your logs to see what else these impostors are searching for. If you're using Fastly Next-Gen WAF with Bot Management, you can use these signals to gain deeper insight and tighter control over your environment.
Thanks to GreyNoise for surfacing this behavior and prompting us to write about our observations from our own network.
Figures are based on Fastly Next-Gen WAF request logs for customers using Bot Management, covering a single day: 23 September 2026 UTC.
