Fake AI Crawler User-Agents Are Probing Cloud Metadata Endpoints

Researchers at HoneyLabs traced a single HTTP client, running from 26 IP addresses (mostly on Google Cloud), that has generated tens of thousands of spoofed AI crawler user-agent strings since late August, impersonating names like Anthropic's Claude-User. By constantly regenerating the same bot name in thousands of variations, the operator defeats allow-lists that match on user-agent text alone.

Because every request still shares a stable JA4H fingerprint — derived from HTTP request structure rather than content — researchers were able to link the changing strings to four distinct tool modules built out over consecutive weeks: a credential and config-file grabber, an SSRF module targeting cloud metadata services, a GraphQL introspection scanner, and a JSON-bodied SSRF variant. Near-identical address overlap across the four points to one operator's toolkit rather than unrelated actors.

The SSRF modules systematically sweep combinations of 14 common fetch/proxy/webhook endpoints against 7 URL parameter names, all aimed at the AWS instance metadata service, local AWS credential files, and /proc/self/environ. Two of the four modules also send Google Cloud metadata headers to arbitrary web servers that have nothing to do with GCP — a signature with no benign explanation.

For engineers, the takeaway is that treating an AI crawler name as grounds for looser access controls is now a real attack surface, and that structural fingerprinting, hostname validation, and header inspection are far more reliable defenses than matching on user-agent strings.