One IP claimed to be Google, OpenAI, Anthropic, Apple and Meta - while hunting for our .env file

Update, 2026-10-05: the pool has one more costume. On 2026-10-05 the tracker learned to recognise Google-CloudVertexBot, the crawler Google runs when a site owner builds a Vertex AI agent on their own site. Until then its requests were filed as generic bots. All 43 of them, from 2026-05-27 to 2026-08-31, failed Google’s reverse-DNS check. They came from seven addresses on Hostodo, Infraly and one network in South Korea, and each of those addresses also posed as other crawlers on the same day, GPTBot and PerplexityBot among them. Four of the seven are among the nine addresses described below; the other three began rotating identities after this post’s window closed. 31 of the 43 requests probed for credentials, config files and admin pages, such as /.env.bak, /credentials.json, /.aws/credentials.json and /.git-credentials; the other 12 fetched test pages. The user agent does not match Google’s documented one either: the real crawler sends a full Chrome string and links to cloud.google.com/enterprise-search, these sent a short string linking to cloud.google.com/vertex-ai-bot.

Correction, 2026-10-03: a re-check against the raw tracker database found several overstatements, all fixed below. The pool explains all of the fake OpenAI-search traffic, not all of it: 189 of 218 OAI-SearchBot requests were genuine. Two of the nine addresses rotated through thirteen vendor identities, not twelve. Eight of the addresses sit on VPS hosts and one on Cloudflare’s network. Five of the nine, not all, requested the secret paths. The fake AI-fetcher requests were not blocked, but 55 of them got a 404 rather than a 200. Real Perplexity fetched /robots.txt and the homepage, not content. The pool’s size is 221 requests (165 in Cloudflare’s logs), not ~198. The spoof table adds rows from both of the tracker’s ingest paths; on Cloudflare’s logs alone GPTBot is 5% fake.

A reader-style objection to our own data: when the tracker marks a PerplexityBot hit “unverified,” maybe that is our failure to recognise legitimate traffic - a stale IP manifest, or vendor stealth-crawling from undisclosed IPs. Perplexity has a documented history of exactly that. So we went looking for our mistake.

We did not find our mistake. We found a costume rack.

How verification works here

For Perplexity and OpenAI the tracker checks the source IP against the vendor’s own published manifest (perplexity.ai/perplexitybot.json, OpenAI’s ranges). For Google, Bing and Apple it does reverse-DNS with forward confirmation. verified = 1 means the IP is in the vendor’s published infrastructure; verified = 0 means it is not.

Over the 80-day window, the spoof rates for the classes that can be checked:

The objection says: maybe that 90% is our blind spot. Two behavioural signals, independent of the IP check, close that door.

Proof one: impossible identity

The fake AI-fetcher hits trace to a pool of nine IPs, rotating up to thirteen distinct crawler identities. Eight sit on VPS hosts, one on Cloudflare’s network. One address, 45.87.41.224 (SpectraIP, Netherlands), presented as all of these:

Proof two: intent

The same pool is not indexing. Five of the nine IPs hunt for secrets: /.env, /.env.backup, /gcp-credentials.json, /service-account.json, /serviceAccountKey.json, /docker-compose.yml, /graphql/console. No legitimate AI crawler scans for service-account keys. This is credential scanning wearing a bot costume.

Share of each class’s fakes that traces to this nine-IP pool: perplexitybot 27/27, chatgpt-user 24/24, oai-searchbot 29/29, gptbot 19/19, google-extended 6/6, applebot 18/19. In this dataset every fake Perplexity, ChatGPT-User and OpenAI-search request comes from one small impersonation pool. For Perplexity and ChatGPT-User that is nearly all of their traffic; OAI-SearchBot’s genuine robots.txt checks (189 of 218 requests) are real.

The real ones are cleanly separable

Every verified = 1 Perplexity hit came from Amazon / AWS (Perplexity’s real infrastructure), fetched /robots.txt and the homepage, and matched the published perplexitybot.json manifest. The manifest verified those AWS IPs correctly, so the “fakes” are not a broken-manifest false negative. Real Perplexity showed up a handful of times and behaved. The costume rack did the rest.

Cloudflare only vets Googlebot

One more asymmetry. Of the fake Googlebot hits, 436 of 453 got a 403 - Cloudflare’s managed reverse-DNS verification catches and blocks them. The fake Perplexity, ChatGPT-User, OAI-SearchBot, GPTBot and Applebot hits got zero 403s. Nothing stopped them: 32 got a 200, the other 55 a 404 for paths that do not exist. Cloudflare hard-verifies Google; the rest are on you.

(The Googlebot fakes are a separate event from the nine-IP pool: 435 of 455 came in a single day, 2026-07-31, from one Dutch hosting ASN flooding / with ~3,000 requests. Different actor, same lesson.)

What this means for site owners

Counting “AI crawler visits” by user-agent is wrong, and wrong in a specific direction. For Perplexity and ChatGPT-User the raw UA count is roughly ten times the verified count. A dashboard reporting “Perplexity crawled you 300 times” is very likely showing a scanner in a Perplexity costume for most of them. GPTBot and Bingbot, which publish verifiable ranges, are only 2-5% inflated - trust those.

Three checks, any one strong, all three dispositive:

1. IP-range / rDNS against the vendor’s published manifest.
2. Behaviour - anything scanning for .env or service-account keys is not a real AI crawler.
3. Per-IP UA rotation - group by source IP, count distinct vendor identities. One IP claiming to be Google and OpenAI and Anthropic is your fastest smoking gun in a client log.

What this does not prove

• The pool is small in absolute terms (221 fake requests, 165 of them in Cloudflare’s logs) on a low-traffic cold-start domain. The ratio and the behaviour are the finding; absolute counts differ on a bigger site.
• It does not identify who runs the pool. The ASNs (Hostodo, Infraly, SpectraIP, Advin, Contabo) are the packet origin, not the actor.
• It does not rule out genuine vendor stealth-crawling in general - only in this window, where no clean-behaving unverified fetch exists to support that reading.

Method notes

Raw IP is retained only for verified = 0 rows (for forensics) and nulled for verified bots (anonymised) - so the per-IP costume analysis is possible precisely because these failed verification. UA classification is regex; verification is IP-range (ip-range method) or reverse-DNS (rdns). The nine-IP pool is defined as distinct source IPs presenting two or more vendor bot classes. The spoof table counts tracker rows from both ingest paths (middleware and Cloudflare logs), so cell requests are counted twice; on Cloudflare’s logs alone the shares move a little, GPTBot from 3% to 5% fake.

Data availability: methodology, tracker code and classifier are in the repository at github.com/Qbeczek1/jsseo-dev, private for now; access on request at [email protected].

Bias disclosure: I run JS SEO Lab as an independent technical SEO research project, and do paid technical SEO and AI-visibility audits through FratreSEO. No crawler vendor, search engine, or AI company funds this work.