AI Bot Impersonators Sent 6.3 Million Requests Hunting for Private Files

AI bot names in a request header can provide cover for a familiar kind of attack: searching websites for exposed credentials and private configuration files. In one day of Fastly Next-Gen WAF logs, about 6.3 million requests claimed to come from AI crawlers or fetchers while probing for sensitive files. Those requests came from nearly 10,200 IP addresses, but a concentrated group drove most of the activity.

The practical lesson is about identity checks. A User-Agent header tells a server what a client claims to be; it doesn’t prove who sent the request. Fastly says it checks whether a connecting address belongs to the vendor named in the header, then adds a VERIFIED-BOT signal when that check succeeds. That distinction helps separate legitimate automated traffic from requests borrowing its identity.

Most traffic passes verification; the impostors don’t

Fastly’s analysis focused on one full day of Next-Gen WAF traffic from customers using Bot Management. The company reports that most AI bot traffic on its network was legitimate and verified. The suspicious requests were those that named a recognizable AI bot but failed the source check while trying to reach private files.

That separation matters for teams that grant known crawlers different access or rate limits from other clients. A name in a header can be copied easily. If access rules rely on that string alone, a scanner can adopt a trusted identity without coming from the service it claims to represent.

Fastly’s findings follow research from GreyNoise, which described malicious bots posing as services from OpenAI, Anthropic, Google, and Perplexity to look for secrets such as private keys, credentials, and API tokens. Fastly examined its own traffic to measure the scale and patterns of this activity in its customer network.

A concentrated operation used rotating bot identities

The ten most frequently impersonated identities each attracted around 500,000 requests. They included bots associated with OpenAI, Anthropic, Perplexity, DuckDuckGo, and Common Crawl. No single identity dominated the reported top ten.

Most of the activity came from one operation. Of roughly 10,200 IP addresses, about 1,600 accounted for 94% of the impostor requests. Fastly says nearly all of that concentrated traffic came from infrastructure hosted by one public cloud provider. Those addresses rotated through a dozen AI bot identities, used about 60 different User-Agent strings, and shared a wordlist of 96 filenames. The requests reached more than 100,000 sites.

The remaining roughly 8,600 addresses formed a long tail. Fastly describes that group as including smaller operations, but mostly addresses that sent a handful of requests while claiming a single bot identity. For defenders, this mix suggests that counts of unique IPs alone can obscure how much traffic belongs to one coordinated effort.

The searches centered on environment files

Environment files were the main target. The 96-name wordlist accounted for nearly all requests attributed to the concentrated operation. Across the full set of traffic, Fastly counted about 3,000 distinct private files and more than 46,000 path variants. Those variants included different prefixes, locale paths, and traversal forms that point toward the same filenames.

The most frequently targeted individual path was /.env, which nearly 1,800 distinct addresses probed during the day. Requests also tried traversal patterns such as /../../../../.env and development-server paths such as /@fs/.env. The latter targets a Vite development-server file route.

That pattern is useful to recognize in logs: a large number of path variations can be generated from a short list of sensitive filenames. A count grouped only by exact URL may scatter the activity across many entries, making the shared target less obvious. Grouping related paths by filename or file type can make the probing pattern easier to see.

Block the false claim when it targets secrets

Exact User-Agent filtering can be fragile because clients can change the string. Fastly’s proposed rule instead checks two conditions: the request claims a known AI bot identity, and that claim has not been verified. When the same request targets confidential files such as .env, the combination gives operators a basis to block it.

For sites using Fastly Next-Gen WAF with Bot Management enabled, the company says a single request rule can apply this logic:

Because the rule relies on the claimed bot identity and verification result, rotating IP addresses or changing among User-Agent strings won’t defeat it while the request continues to claim a known AI bot name. Its scope also points to a practical consideration: teams should check how their rules treat unverified bot claims and which sensitive paths they want to protect.

Check what the logs reveal

Impersonation can work where sites trust a familiar User-Agent, allow it through, or give it looser rate limits. Source verification closes that gap by checking where the request came from instead of relying on the name it presents. It doesn’t remove the need to protect private files themselves, but it can help identify and filter requests that pair a false bot identity with credential hunting.

Teams can review their logs for both the claimed identities and the paths being requested, then look for bursts of related filename variants. Fastly points customers to its Next-Gen WAF and Bot Management signals for deeper visibility and control. The reported measurements cover one day, 23 September 2026 UTC, so they show a snapshot rather than a longer-term rate. The useful next step is to see whether the same identity and path patterns appear in an organization’s own traffic.

Fastly credited GreyNoise for surfacing the behavior that prompted its analysis. The figures are based on Fastly Next-Gen WAF request logs for customers using Bot Management.