{
  "title": "EU AI Readiness Observatory — Threat Note 01: Some crawlers are thieves in disguise",
  "version": "1.0",
  "published": "2026-09-09",
  "observation_window": {
    "description": "90 days ending 2026-09-08",
    "temporal_coverage": "2026-06-10/2026-09-08"
  },
  "scope": {
    "host": "verisai.eu",
    "request_classes": [
      "ai_scored",
      "ai_secondary"
    ]
  },
  "headline": {
    "AI-labelled requests": 12948,
    "Provider-verified requests": 2884,
    "Unverified requests": 10064,
    "Sensitive-target attempts": 4355,
    "Distinct hashed source IPs": 122,
    "Active days": 67
  },
  "summary_definitions": {
    "AI-labelled requests": "Recognised AI crawler identity in the User-Agent",
    "Provider-verified requests": "VerisAI provider identity verification passed",
    "Unverified requests": "Claimed identity could not be confirmed",
    "Sensitive-target attempts": "Unverified request targeted secrets, configuration, source or runtime endpoints",
    "Distinct hashed source IPs": "Unique source IPs counted through irreversible hashes",
    "Active days": "Days with at least one unverified AI-labelled request"
  },
  "target_categories": [
    {
      "category": "Environment variables",
      "requests": 2249,
      "distinct_hashed_source_ips": 58,
      "distinct_paths": 208
    },
    {
      "category": "Credentials, keys and secrets",
      "requests": 1300,
      "distinct_hashed_source_ips": 51,
      "distinct_paths": 159
    },
    {
      "category": "Application configuration",
      "requests": 346,
      "distinct_hashed_source_ips": 52,
      "distinct_paths": 8
    },
    {
      "category": "Runtime and API probing",
      "requests": 247,
      "distinct_hashed_source_ips": 36,
      "distinct_paths": 9
    },
    {
      "category": "Source and deployment files",
      "requests": 213,
      "distinct_hashed_source_ips": 45,
      "distinct_paths": 10
    }
  ],
  "top_claimed_identities_for_sensitive_targets": [
    {
      "claimed_identity": "ChatGPT-User",
      "requests": 731,
      "distinct_hashed_source_ips": 60,
      "distinct_paths": 251
    },
    {
      "claimed_identity": "Amazonbot",
      "requests": 676,
      "distinct_hashed_source_ips": 17,
      "distinct_paths": 278
    },
    {
      "claimed_identity": "Claude-SearchBot",
      "requests": 447,
      "distinct_hashed_source_ips": 11,
      "distinct_paths": 113
    },
    {
      "claimed_identity": "OAI-SearchBot",
      "requests": 394,
      "distinct_hashed_source_ips": 38,
      "distinct_paths": 197
    },
    {
      "claimed_identity": "GPTBot",
      "requests": 386,
      "distinct_hashed_source_ips": 35,
      "distinct_paths": 186
    },
    {
      "claimed_identity": "ClaudeBot",
      "requests": 351,
      "distinct_hashed_source_ips": 34,
      "distinct_paths": 166
    },
    {
      "claimed_identity": "PerplexityBot",
      "requests": 338,
      "distinct_hashed_source_ips": 36,
      "distinct_paths": 154
    }
  ],
  "top_sensitive_paths": [
    {
      "path": "/.env",
      "requests": 87,
      "distinct_hashed_source_ips": 42,
      "claimed_bot_identities": 15,
      "potential_target": "Environment secrets and database/API credentials"
    },
    {
      "path": "/.git/HEAD",
      "requests": 81,
      "distinct_hashed_source_ips": 39,
      "claimed_bot_identities": 12,
      "potential_target": "Repository presence and current branch reference"
    },
    {
      "path": "/.git/config",
      "requests": 74,
      "distinct_hashed_source_ips": 38,
      "claimed_bot_identities": 13,
      "potential_target": "Repository remotes and deployment metadata"
    },
    {
      "path": "/graphql",
      "requests": 71,
      "distinct_hashed_source_ips": 34,
      "claimed_bot_identities": 13,
      "potential_target": "Queryable application API surface"
    },
    {
      "path": "/.env.local",
      "requests": 63,
      "distinct_hashed_source_ips": 43,
      "claimed_bot_identities": 13,
      "potential_target": "Local environment secrets"
    },
    {
      "path": "/.env.production",
      "requests": 61,
      "distinct_hashed_source_ips": 43,
      "claimed_bot_identities": 13,
      "potential_target": "Production environment secrets"
    },
    {
      "path": "/firebase-adminsdk.json",
      "requests": 56,
      "distinct_hashed_source_ips": 36,
      "claimed_bot_identities": 13,
      "potential_target": "Cloud service-account credentials"
    },
    {
      "path": "/config.json",
      "requests": 56,
      "distinct_hashed_source_ips": 40,
      "claimed_bot_identities": 13,
      "potential_target": "Application configuration"
    },
    {
      "path": "/api/env",
      "requests": 56,
      "distinct_hashed_source_ips": 39,
      "claimed_bot_identities": 13,
      "potential_target": "Runtime environment exposure"
    },
    {
      "path": "/.env.development",
      "requests": 56,
      "distinct_hashed_source_ips": 38,
      "claimed_bot_identities": 14,
      "potential_target": "Development environment secrets"
    },
    {
      "path": "/.env.bak",
      "requests": 56,
      "distinct_hashed_source_ips": 42,
      "claimed_bot_identities": 14,
      "potential_target": "Backup copy of environment secrets"
    },
    {
      "path": "/api/config",
      "requests": 55,
      "distinct_hashed_source_ips": 39,
      "claimed_bot_identities": 13,
      "potential_target": "Runtime application configuration"
    },
    {
      "path": "/secrets.json",
      "requests": 51,
      "distinct_hashed_source_ips": 38,
      "claimed_bot_identities": 12,
      "potential_target": "Generic secret storage file"
    },
    {
      "path": "/.env.backup",
      "requests": 51,
      "distinct_hashed_source_ips": 42,
      "claimed_bot_identities": 14,
      "potential_target": "Backup copy of environment secrets"
    },
    {
      "path": "/service-account.json",
      "requests": 49,
      "distinct_hashed_source_ips": 34,
      "claimed_bot_identities": 12,
      "potential_target": "Cloud service-account credentials"
    },
    {
      "path": "/gcp-credentials.json",
      "requests": 47,
      "distinct_hashed_source_ips": 31,
      "claimed_bot_identities": 12,
      "potential_target": "Google Cloud credentials"
    },
    {
      "path": "/credentials.json",
      "requests": 47,
      "distinct_hashed_source_ips": 35,
      "claimed_bot_identities": 13,
      "potential_target": "Generic credentials file"
    },
    {
      "path": "/actuator/env",
      "requests": 47,
      "distinct_hashed_source_ips": 35,
      "claimed_bot_identities": 13,
      "potential_target": "Application runtime environment"
    },
    {
      "path": "/.aws/credentials",
      "requests": 40,
      "distinct_hashed_source_ips": 35,
      "claimed_bot_identities": 17,
      "potential_target": "AWS access credentials"
    }
  ],
  "observed_network_owners": [
    {
      "network_owner": "Google LLC",
      "requests": 7049,
      "distinct_hashed_source_ips": 29,
      "claimed_bot_identities": 18
    },
    {
      "network_owner": "Infraly, LLC",
      "requests": 1370,
      "distinct_hashed_source_ips": 13,
      "claimed_bot_identities": 8
    },
    {
      "network_owner": "Limestone Networks, Inc.",
      "requests": 618,
      "distinct_hashed_source_ips": 4,
      "claimed_bot_identities": 8
    },
    {
      "network_owner": "Cloudflare, Inc.",
      "requests": 442,
      "distinct_hashed_source_ips": 11,
      "claimed_bot_identities": 14
    },
    {
      "network_owner": "Cloudflare London, LLC",
      "requests": 105,
      "distinct_hashed_source_ips": 17,
      "claimed_bot_identities": 13
    },
    {
      "network_owner": "DigitalOcean, LLC",
      "requests": 101,
      "distinct_hashed_source_ips": 3,
      "claimed_bot_identities": 8
    },
    {
      "network_owner": "Ambyre LLC",
      "requests": 69,
      "distinct_hashed_source_ips": 1,
      "claimed_bot_identities": 8
    },
    {
      "network_owner": "Rackvolt Cloud Solutions Private Limited",
      "requests": 65,
      "distinct_hashed_source_ips": 1,
      "claimed_bot_identities": 8
    },
    {
      "network_owner": "NITEX ISP s.r.o.",
      "requests": 57,
      "distinct_hashed_source_ips": 1,
      "claimed_bot_identities": 6
    }
  ],
  "network_finding": {
    "network_owner": "Google LLC",
    "requests": 7049,
    "share_of_unverified_percent": 70.0,
    "distinct_hashed_source_ips": 29,
    "reverse_dns_suffix": ".googleusercontent.com",
    "attribution_warning": "Network ownership does not identify the operator."
  },
  "leak_check": {
    "date": "2026-09-08",
    "paths": [
      "/",
      "/.env",
      "/.aws/credentials",
      "/.git/config"
    ],
    "http_status": 200,
    "content_type": "text/html",
    "response_bytes": 91450,
    "result": "Public homepage HTML; no credential, configuration or source-code leak found."
  },
  "methodology": "https://verisai.eu/observatory/data/threat-note-01-methodology.md",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "required_attribution": "VerisAI, EU AI Readiness Observatory, verisai.eu",
  "privacy": "No raw IP addresses, request IDs or full User-Agent strings are published."
}