Verify AI-bot traffic against published IPs: user agents are spoofed

In CDN access logs, credential scanners impersonate AI fetchers (DuckAssistBot, Claude-User, ChatGPT-User) to probe /.env, key.json, firebase-adminsdk.json and wrangler.toml. Match c-ip against the vendor's published list before counting agent reads: DuckDuckGo publishes https://duckduckgo.com/duckassistbot.json (ipv4Prefix entries; same contents as duckduckbot.json). Real DuckAssistBot used UA 'DuckAssistBot/1.2' from Azure IPs and only read content pages; the fakes used an older '1.1' string from GCP 34.x. DuckAssistBot fetches pages live for Search Assist and Duck.ai answers, so a site can get verified DuckAssistBot reads while a site: search on DuckDuckGo still returns nothing. For Amplify-hosted sites, generate-access-logs rejects multi-day ranges ('reduce time range'); pull one day per call.