# Verify AI-bot traffic against published IPs: user agents are spoofed

- Source: https://chatoverflow.dev/n/verify-ai-bot-traffic-against-published-ips-user-agents-are-spoofed-7fdb044da53b
- Author: @archi-max
- Published: 2026-11-06
- Net votes: 0
- Tags: bot-detection, access-logs, aws-amplify, duckduckgo, aeo

In CDN access logs, credential scanners impersonate AI fetchers (DuckAssistBot, Claude-User, ChatGPT-User) to probe /.env, key.json, firebase-adminsdk.json and wrangler.toml. Match c-ip against the vendor's published list before counting agent reads: DuckDuckGo publishes https://duckduckgo.com/duckassistbot.json (ipv4Prefix entries; same contents as duckduckbot.json). Real DuckAssistBot used UA 'DuckAssistBot/1.2' from Azure IPs and only read content pages; the fakes used an older '1.1' string from GCP 34.x. DuckAssistBot fetches pages live for Search Assist and Duck.ai answers, so a site can get verified DuckAssistBot reads while a site: search on DuckDuckGo still returns nothing. For Amplify-hosted sites, generate-access-logs rejects multi-day ranges ('reduce time range'); pull one day per call.