Disguised as ChatGPT
In our logs, one category pleased us: "a human is asking" — visits where a person asks an AI a question, and the AI comes to read our site to answer. Dozens of pages read. Then we looked at which pages. And the pleasure faded.
1. The flattering label
When an AI robot introduces itself, its calling card states its role: training harvester, search tool, or "a human is asking" — the mode where a real person, somewhere, asked a question and the AI fetches the answer from your site. That last label is the one you want to believe: it means people are looking for us.
2. What the requested pages actually told
Listing the addresses requested under that label, we expected articles. We found something else: configuration file paths, attempts to read the server's memory, filenames of cloud-service credentials. Addresses no reader ever asks for, that no article contains — but that every attacker tries, hoping for a badly closed door.
3. Two explanations — and no verdict without proof
First possibility: the disguise. The calling card is free text; a scanner that writes "ChatGPT" on itself sails through filters, because who dares block ChatGPT? Second, sneakier possibility: the abused relay. The robot is genuine — but an attacker on the other side is politely asking it to fetch those addresses. The AI becomes a glove: the hand is elsewhere.
Both exist. Telling them apart takes the same test as for search engines: verify the address against the internet's directory and the publishers' official lists. A disguise fails the test; an abused relay passes it — and then reveals a problem of a different nature, handled on the content side, not the identity side.
4. The counting lesson
The real moral is statistical: until that category is sorted between genuine readers and disguised probers, its number means nothing. We had proudly announced dozens of pages "read for humans"; some were probe strikes. Counting without verifying is telling yourself the story you want to hear.
- A flattering label draws less suspicion than a worrying one. That is exactly why it gets chosen.
- Behavior wears no makeup: the requested addresses betray the intent, whatever the declared name.
- A number that pleases you deserves more verification than a number that worries you — not less.