Fake ClaudeBot Is the New Fake Googlebot

Known Agents, an analytics service tracking bot traffic across 5,000+ sites, flagged a campaign where mass vulnerability scans spoof legitimate AI crawler user-agents like ClaudeBot to probe for credential files such as /.claude/settings.json and /.aws/credentials, targeting secrets left by AI coding tools. The disguise exploits operators' tendency to allowlist AI bots, and while it risks reputational damage to Anthropic, the spoofing is a tactical blunder because ClaudeBot's IP ranges are publicly verifiable, aiding defenders.

Security https://sourcefeed.dev/c/security Article Fake ClaudeBot Is the New Fake Googlebot Mass vulnerability scans are hiding behind AI crawler user-agents, hunting the credential files AI coding tools leave behind. Ji-ho Choi https://sourcefeed.dev/u/jiho choi Anyone can be ClaudeBot. One curl flag is all it takes: curl -A 'Mozilla/5.0 AppleWebKit/537.36 KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com ' \ https://yoursite.com/.claude/settings.json That's the trick behind a campaign that Known Agents https://knownagents.com/insights , an analytics service tracking bot traffic across 5,000+ sites, flagged this week: mass vulnerability scans wearing the user-agents of legitimate AI crawlers — ClaudeBot among them — while probing for credential and configuration files. The report hit the Hacker News front page, and the reflexive response there was fair: every public server eats thousands of junk probes a day. But this one deserves more attention than the usual WordPress-login noise, because both the disguise and the targets tell you something about where attackers think the soft spots are in 2026. They're hunting your AI tool credentials The paths in the scan logs aren't the old wp-login.php playbook. Known Agents reports probes for /.claude/settings.json , /.aws/credentials , .env files, and Docker and Terraform configs — the secrets footprint of a modern AI-assisted dev workflow. That target list is independently corroborated. A SANS Internet Storm Center diary https://isc.sans.edu/diary/32896 from April documented a scanner that had been systematically requesting .claude/settings.json , .claude/.credentials.json , OpenClaw workspace secrets, and Hugging Face tokens since March. The logic is obvious once you see it: an Anthropic or OpenAI API key harvested from a sloppily deployed web root is immediately monetizable — resold for LLM access or burned through directly — and AI coding tools have scattered fresh, poorly-guarded credential files across millions of machines faster than deployment hygiene has caught up. Every one of those dotfiles is a mistake away from being served by nginx. What's new in this week's wave is the camouflage. Why ClaudeBot is the perfect disguise Spoofing a trusted crawler is an old move — attackers wore Googlebot's user-agent for two decades because sites allowlisted it to protect their SEO. What's changed is which bot you'd rather be. AI crawler traffic is now a huge, tolerated slice of most sites' logs, and a growing number of operators deliberately give it a pass because AI-assistant referrals and answer-engine visibility have become a marketing channel. The same "don't block the AI bots" posture that GEO consultants push is exactly what makes an AI-bot user-agent the best camouflage on the web. The disguise pays off twice more. In a log review, a scan from "ClaudeBot" blends into thousands of legitimate crawler hits instead of standing out like a raw scanner IP. And when it is noticed, the blame lands on Anthropic — feeding the already-heated "AI crawlers are hammering my site" discourse with incidents Anthropic had nothing to do with. Some of the anger you've read about abusive AI scrapers is real; some of it, it now turns out, is aimed at whoever attackers chose to impersonate that day. That reputational poisoning is a genuine casualty here, and it muddies every future argument about crawler behavior that relies on log evidence alone. Spoofing a verifiable bot is a gift to defenders Here's the editorial part, and it cuts against the doom framing: impersonating ClaudeBot is a tactical blunder, because ClaudeBot is verifiable and a generic Chrome user-agent isn't. Anthropic publishes machine-readable IP ranges for its crawlers at claude.com/crawling/bots.json https://claude.com/crawling/bots.json — a reversal of its earlier no-published-ranges stance. Google and OpenAI publish equivalents. That turns the spoof into a free, high-fidelity detection signature: a request that claims to be ClaudeBot but arrives from an IP outside Anthropic's published ranges is malicious with near-certainty. No legitimate traffic matches that predicate. Known Agents' own detection method is exactly this — flag identity claims that fail published-IP checks — and it's a rule any of us can replicate in a WAF this afternoon. You can't say the same about a scanner pretending to be Chrome on macOS, which is indistinguishable from your actual users. The longer arc bends the same direction. Web Bot Auth https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture , the IETF effort built on RFC 9421 HTTP Message Signatures, has crawlers sign requests with Ed25519 keys that sites verify against published directories. Cloudflare folded it into its Verified Bots program, AWS WAF and Akamai added support, and an IETF working group was chartered this year. Major AI operators — Anthropic and OpenAI included — are signing. It's ironic and telling: the AI crawler wave that caused so much grief for site operators is what finally forced cryptographic bot identity onto the web, after twenty years of fake Googlebots failing to. What to change this week Concretely, in rough order of payoff: Turn the spoof into an alarm. Add an edge rule: user-agent matches a known AI crawler and source IP fails the operator's published ranges → block and log. On Cloudflare, verified-bot status gives you this for free; elsewhere, sync bots.json and the Google/OpenAI equivalents into your WAF on a cron. Kill the dotfile paths at the edge. /.env , /.git/ , /.aws/ , /.claude/ and friends should return 404 from your CDN or reverse proxy before requests ever reach an origin, regardless of whether anything is actually there. If any of those paths have ever returned 200, rotate those credentials now — scanners found them before you did. Stop treating user-agents as identity anywhere. Not in rate-limit exemptions, not in analytics-driven decisions, not in incident attribution. A UA string is a self-reported costume. One caveat for calibration: the "widespread campaign" framing rests on Known Agents' telemetry, a vendor with an agent-identification API to sell and no published volume numbers for the spoofed traffic. Treat the scale claim as plausible rather than proven. But the target paths match independent SANS sensor data, the spoofing technique is trivially reproducible, and the defensive moves above are worth making even if this particular wave turns out to be one actor with a big botnet. The cheap era of trusting the User-Agent header was already over; this is just the invoice arriving. Sources & further reading - Agentic Web Index - active threat: AI bot impersonation campaign https://knownagents.com/insights — knownagents.com - Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot https://news.ycombinator.com/item?id=49272569 — news.ycombinator.com - Scanning for AI Models https://isc.sans.edu/diary/32896 — isc.sans.edu - Does Anthropic crawl data from the web, and how can site owners block the crawler? https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler — support.claude.com - HTTP Message Signatures for automated traffic - Architecture https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture — datatracker.ietf.org - Message Signatures are now part of our Verified Bots Program https://blog.cloudflare.com/verified-bots-with-cryptography/ — blog.cloudflare.com Ji-ho Choi https://sourcefeed.dev/u/jiho choi · Security & Cloud Editor Ji-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept. Discussion 0 No comments yet Be the first to weigh in.