EnvGuard: crawler spoofing audit

Find out which 'AI crawlers' are really faking GPTBot to scrape your .env files

Problem

Sites let AI crawlers in to appear in ChatGPT and Perplexity answers, then attackers spoof GPTBot, ClaudeBot, GrokBot, and Googlebot UAs. One server hit a site 66 times in 12 seconds, every request claiming a different bot and asking for a different .env file. The fix is IP verification, not UA trust, but most small teams lack tooling and time.

Solution

A lightweight hosted or self-hosted audit service parses access logs, validates every self-declared AI crawler against official IP ranges, flags spoofed traffic and sensitive-path probing, and generates actionable WAF/nginx/Cloudflare rules plus a daily security brief.

Users

SaaS and content site owners who allow AI crawlers but have no security headcount

MVP

Upload or connect access logs; live official crawler IP lookup; UA/IP mismatch alerts; sensitive-path probing detection; export firewall rules

Revenue

Usage-based subscription by log volume, low tier for indie sites, one-time WAF rule pack

Why now

AI crawler access is a growth must while spoofed scanner traffic is surging, and verification data is public, so tooling can be built now