GreyNoise: Scanners Impersonating OpenAI, Anthropic and DeepSeek Crawlers Hunt Credentials Across 824 IPs

GreyNoise disclosed that threat actors are impersonating web crawlers from OpenAI, Anthropic, DeepSeek, Google, Perplexity and Amazon to scan internet-facing servers for .env files, cloud access keys, private keys and AWS credentials. Six spoofed crawler names were seen across 824 IPs on 795 distinct /24 networks between July 28 and Aug 23, 2026, and the fake crawlers never requested /robots.txt (real Anthropic bots do 12% of the time). Site owners that allowlist AI crawlers by user-agent alone are exposed; GreyNoise published the full IP list.