In late August 2026, the security firm GreyNoise found 824 IP addresses across 795 separate networks sending requests that identified themselves as GPTBot, ClaudeBot, PerplexityBot, and other AI crawlers. None of those addresses matched the IP ranges the real companies publish. The scanners weren't gathering content for an AI answer. They were probing for exposed .env files and AWS credentials, and more than 263,000 of the forged sessions used a user agent, Google-Extended, that Google's own crawlers never actually send. For any site that keeps its firewall open for AI crawlers to stay visible in ChatGPT or Perplexity, that traffic pattern is a direct problem: the request claiming to be a citation-gathering bot might be neither.
What GreyNoise found in its August 2026 crawler-impersonation report
GreyNoise's sensor network logged the forged traffic between July 28 and August 23, 2026, with activity peaking on the final day of that window. The 824 addresses impersonated six AI crawler names from four companies, Anthropic, OpenAI, Google, and Perplexity, plus a separate and larger wave of forged Amazon crawler names. Every session requested known credential paths: /.env, /.env.production, /.aws/credentials, /.git/config. No legitimate AI crawler has any reason to ask for a site's environment file.
That specificity is what makes the pattern easy to catch once you know what to look for. Analyzing AI crawler traffic in your server logs is the first place to check, and a credential-path request is one of the clearest tells available: a bot that exists to summarize or cite your content doesn't need your secrets. GreyNoise's recommendation is to alert on any request for a credential path regardless of the user agent attached to it, since a legitimate crawler asking for /.env is a contradiction in terms, not an edge case worth debating.
Why this is a GEO problem, not only a security one
Brands increasingly leave robots.txt open for GPTBot, ClaudeBot, and PerplexityBot specifically so their content can be crawled and cited in AI answers. That same open door has no built-in way to tell a real citation-gathering crawler from a scanner wearing its name, which means the access most GEO advice recommends can't by itself keep the wrong traffic out.
Sites that track their crawl-to-refer ratio to judge whether AI crawling is worth the bandwidth now have a confound sitting in the data: forged sessions inflate the crawl side of that ratio without producing any of the citations on the refer side. A separate decision entirely is whether to let a real training crawler in at all; blocking AI training can quietly cost you citations elsewhere on a domain, but that's a policy choice enforced through a robots.txt disallow rule. Impersonation ignores robots.txt outright, since a scanner faking GPTBot's name was never going to read the file it's supposed to obey in the first place.
The practical risk runs in both directions. Treat every request that names an AI crawler as trustworthy, and a site hands out credential paths and bandwidth to scanners with nothing to do with citations. Treat every unverified request as hostile and block on user agent alone, and a site risks throttling the real GPTBot or PerplexityBot sessions that would have surfaced its content in an answer. Verification, not blanket allow or block rules, is what separates the two outcomes.
Why "Google-Extended" in your logs is always fake
Google-Extended is not a crawler. It is a robots.txt permission token that controls whether content Googlebot already fetched can be used to train Gemini or ground its answers, and Google's own developer documentation confirms it has no separate HTTP request user agent of its own. Any request that arrives with "Google-Extended" as its user agent, including the 263,849 GreyNoise logged in three weeks, is fabricated by definition.
Google-Extended has no crawler of its own. A request arriving with that user agent has already failed the identity check, because the real Google-Extended never sends one.
That single fact makes Google-Extended the easiest impersonation to catch. Unlike GPTBot or PerplexityBot, there is no legitimate baseline traffic to separate it from: every hit is noise, and GreyNoise found most of it aimed at cloud credentials rather than content. A firewall rule that simply drops any request self-identifying as Google-Extended costs nothing and blocks nothing real, which makes it one of the rare cases in this whole problem where the fix is unambiguous.
How OpenAI and Perplexity let you check whether a crawler is real
OpenAI and Perplexity both publish machine-readable IP range lists, at openai.com/gptbot.json and through Perplexity's crawler documentation, so a request claiming to be GPTBot or PerplexityBot can be checked against a real address list instead of trusted on the user agent string alone.
Perplexity's own documentation recommends checking both signals together: match the user agent to PerplexityBot, then match the source IP to its current published range, because either one alone is trivial to fake. OpenAI's list is timestamped and updated on a rolling basis, so a verification script needs to pull it fresh rather than caching an old copy, the same problem researchers flagged in OpenAI's developer forum when site owners spotted GPTBot traffic arriving from IPs absent from the published range. A stale copy of either list is close to useless: it tells you what was true last month, not what's hitting your server right now.
Why ClaudeBot is harder to verify than OpenAI's or Perplexity's crawlers
Anthropic takes a different approach. Its support documentation states that IP blocking of ClaudeBot "may not work reliably," because the crawler runs on shared cloud infrastructure, and unlike OpenAI or Perplexity, Anthropic does not publish a stable IP range for site owners to check requests against.
That is a genuine trade-off for brands chasing Claude citations. How to get cited by Claude AI covers how legitimate ClaudeBot access shapes what Claude includes in an answer, but the absence of a public IP list means a site can really only police that access through robots.txt compliance, and a scanner impersonating ClaudeBot has no reason to comply with a file it never intended to read. Until Anthropic publishes something equivalent to OpenAI's or Perplexity's address lists, server-log pattern checks, like requests never touching robots.txt or hitting credential paths, are the more reliable signal for ClaudeBot specifically.
Cloudflare's fix: cryptographically signed bot requests
Cloudflare's Web Bot Auth, developed with the IETF and folded into its Verified Bots program in 2025, lets a crawler cryptographically sign its HTTP requests so a receiving server can confirm identity mathematically, rather than trusting an IP list that might already be stale or a user agent that costs nothing to fake.
OpenAI's ChatGPT agent was among the first cohort to adopt signed requests when Cloudflare launched the classification in August 2025, alongside browser-automation tools like Goose and Browserbase. Sites already using Cloudflare's bot management to avoid accidentally blocking legitimate AI crawlers can turn on signature verification today. It is the first identification method in this space that does not depend on a list someone has to remember to keep current, and it is the closest thing to a real fix for the GreyNoise scenario: a signature either checks out or it doesn't, with no IP list to go stale in between.
A practical checklist for verifying AI crawler traffic
None of the individual checks above requires new tooling. Together, applied in order, they catch the pattern GreyNoise documented without requiring a site to block every bot that claims an AI company's name.
Match the source IP, not just the user agent, against OpenAI's and Perplexity's published ranges before trusting a request.
Treat every "Google-Extended" hit in your logs as fake. Google's real crawlers never send that user agent themselves.
Flag any self-declared AI crawler that never requests robots.txt first; real crawlers check it before anything else.
Watch for requests to credential paths like /.env or /.aws/credentials. No legitimate crawler needs them, regardless of what name it claims.
Where your provider supports it, turn on cryptographic bot verification such as Web Bot Auth instead of relying on IP allowlists alone.
Frequently Asked Questions
How can I tell if a bot claiming to be GPTBot is actually OpenAI?
Check the source IP against OpenAI's published range at openai.com/gptbot.json rather than trusting the user agent string alone, since any scanner can set its user agent to say "GPTBot." GreyNoise found 824 addresses in 2026 sending traffic under AI crawler names, including GPTBot, and none of them matched any company's published ranges, which is exactly the mismatch this check is built to catch.
Does Anthropic publish an IP range for ClaudeBot?
No. Anthropic's own support documentation says IP blocking "may not work reliably" for ClaudeBot because the crawler runs on shared cloud infrastructure that changes over time. That leaves site owners relying mainly on robots.txt compliance rather than an address list, which only works against crawlers that actually read the file.
Why did GreyNoise see 263,849 fake Google-Extended sessions?
Because Google-Extended isn't a crawler at all, according to Google's own developer documentation. It's a robots.txt permission token that governs how already-crawled content can be used, with no HTTP requests of its own. That means every single request arriving with that user agent is fabricated, no matter how large the volume gets.
What should I do if I find fake AI crawler traffic hitting credential paths?
Rotate any cloud keys or credentials that were reachable through the requested paths immediately, move .env files and other credential stores outside the web root, and block the offending addresses at the firewall. Real AI crawlers, whatever name they use, have no legitimate reason to request those paths in the first place.
Is Cloudflare's Web Bot Auth the same thing as robots.txt?
No. robots.txt is a voluntary text file that any crawler can simply ignore, which is exactly what the impersonators GreyNoise documented did while still claiming AI-crawler names. Web Bot Auth instead uses cryptographic signatures that a server can verify mathematically, so identity no longer depends on what the visiting request claims about itself.