Scanners spoofing OpenAI, Anthropic, Google and Perplexity AI crawlers probe for .env files, cloud keys and credentials
GreyNoise observed automated scanners impersonating the web crawlers of OpenAI, Anthropic, Google, Perplexity, DeepSeek and Amazon while requesting environment files, cloud access keys, private keys and password stores. A cluster of 13 forged AI crawler names from eight companies was seen; six names (belonging to Anthropic, OpenAI, Google and Perplexity) arrived in matched volume from the same 824 addresses between July 28 and August 23, 2026, mostly in August. None of the source addresses matched the published IP ranges of the impersonated vendors, and the six forged names never requested /robots.txt, unlike the real ClaudeBot, which requests it most often and never asks for credential files. GreyNoise sees only requests arriving, does not say any file was returned or any organization affected, and does not attribute the activity.
Technical Details
- The six forged names shared one HTTP client fingerprint (JA4H), which over 90 days also carried more than 1,500 user agent strings, mostly ordinary browsers.
- The forged ClaudeBot string matches Anthropic's character for character, so user-agent-keyed rules cannot tell them apart. Two Amazon crawler names were also forged, in higher volume, and do not match Amazon's documented user agent.
- Google-Extended is a robots.txt token, not an HTTP user agent, so all 263,849 sessions carrying it were forged.
- The 824 addresses are spread across 795 separate /24 networks, which makes network-based blocking impractical. Most sessions carry the same Web Crawler label as real crawler traffic.
- Requested paths include /.env, /.aws/credentials and /.git/config. Associated GreyNoise tags: Generic Sensitive File Access Attempt, AWS Configuration Scanner, Vite Arbitrary File Disclosure CVE-2025-30208 Attempt, EC2 IAM Credential Access Attempt.
Remediation
- Never treat a user agent as identity: verify the connecting address against the vendor's published list for the claimed crawler name, and give each list an owner and refetch schedule.
- Alert on any request for /.env, /.aws/credentials or /.git/config, and review everywhere a user agent grants access or waives a control.
- Judge crawlers that never request /robots.txt across days rather than single visits.
- Keep .env, .git and cloud credential files out of the web root, and rotate any cloud key ever reachable from a web path.
- Upgrade Vite to 6.2.3, 6.1.2, 6.0.12, 5.4.15 or 4.5.10.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2025-30208. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Vite 6.2.2 - Arbitrary File Read
This script targets CVE-2025-30208 in the Vite frontend dev server, where a crafted query suffix on a file-serving route bypasses the allow-list and returns arbitrary files to the browser. The attacker needs only network reach to a dev server deliberately exposed beyond localhost, with no authentication or user interaction, on an unpatched version (6.2.2 and earlier branches). It is a simple working proof of concept: it sends one request, reports whether file content came back, and can scan a list of hosts. It genuinely matches the CVE and reads files such as system account files.
Linha do tempo
-
Scanners spoofing OpenAI, Anthropic, Google and Perplexity AI crawlers probe for .env files, cloud keys and credentials
ler a análise desta fonte ocultar
GreyNoise observed automated scanners impersonating the web crawlers of OpenAI, Anthropic, Google, Perplexity, DeepSeek and Amazon while requesting environment files, cloud access keys, private keys and password stores. A cluster of 13 forged AI crawler names from eight companies was seen; six names (belonging to Anthropic, OpenAI, Google and Perplexity) arrived in matched volume from the same 824 addresses between July 28 and August 23, 2026, mostly in August. None of the source addresses matched the published IP ranges of the impersonated vendors, and the six forged names never requested /robots.txt, unlike the real ClaudeBot, which requests it most often and never asks for credential files. GreyNoise sees only requests arriving, does not say any file was returned or any organization affected, and does not attribute the activity.
Technical Details
- The six forged names shared one HTTP client fingerprint (JA4H), which over 90 days also carried more than 1,500 user agent strings, mostly ordinary browsers.
- The forged ClaudeBot string matches Anthropic's character for character, so user-agent-keyed rules cannot tell them apart. Two Amazon crawler names were also forged, in higher volume, and do not match Amazon's documented user agent.
- Google-Extended is a robots.txt token, not an HTTP user agent, so all 263,849 sessions carrying it were forged.
- The 824 addresses are spread across 795 separate /24 networks, which makes network-based blocking impractical. Most sessions carry the same Web Crawler label as real crawler traffic.
- Requested paths include /.env, /.aws/credentials and /.git/config. Associated GreyNoise tags: Generic Sensitive File Access Attempt, AWS Configuration Scanner, Vite Arbitrary File Disclosure CVE-2025-30208 Attempt, EC2 IAM Credential Access Attempt.
Remediation
- Never treat a user agent as identity: verify the connecting address against the vendor's published list for the claimed crawler name, and give each list an owner and refetch schedule.
- Alert on any request for /.env, /.aws/credentials or /.git/config, and review everywhere a user agent grants access or waives a control.
- Judge crawlers that never request /robots.txt across days rather than single visits.
- Keep .env, .git and cloud credential files out of the web root, and rotate any cloud key ever reachable from a web path.
- Upgrade Vite to 6.2.3, 6.1.2, 6.0.12, 5.4.15 or 4.5.10.