Someone Is Spoofing ClaudeBot to Run Mass Vulnerability Scans

If you run a web server, you probably spend a decent amount of time combing through access logs. Most of it is normal background noise: search engine spiders indexing your pages, random bots scanning for open ports, and regular user traffic. But lately, security teams have noticed a weird trend in the log files. A massive wave of vulnerability scans is hitting public-facing servers, and they all claim to be Anthropic's AI crawler, ClaudeBot.

It is not actually Anthropic. Malicious actors are spoofing the ClaudeBot user agent to bypass firewall rules and search for low-hanging fruit like exposed .env files, open .git directories, and unpatched WordPress plugins.

This is user agent spoofing at scale. It works because of a common shortcut in web administration: trusting the client's self-reported identity to make firewall decisions.

The Lazy Whitelist Problem

Webmasters have a complicated relationship with AI crawlers. Some block them entirely to protect their content from being used to train LLMs. Others want their sites to show up in AI-assisted search results, so they explicitly whitelist bots like GPTBot, ClaudeBot, and Google-Extended.

This whitelisting is often handled at the Web Application Firewall (WAF) level. A simple rule might look like this: if the User-Agent header contains "ClaudeBot", let the traffic through without triggering rate limits or challenge pages.

Attackers know this. They also know that configuring a web server to verify the actual origin of every single bot request takes extra effort. By simply changing their scraper's user agent header to match Anthropic's official string, they can slide right past basic security rules.

Once inside, these fake bots do not crawl your blog posts. They immediately start hammering sensitive endpoints. They look for configuration files containing database credentials, backup zip files left in the public root, and admin login panels with known vulnerabilities.

Spotting the Fakes in Your Logs

Detecting these fake requests is straightforward if you know what to look for. A legitimate request from Anthropic will use their official user agent string:

Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

But the header is just a text string. Anyone can write a Python script using the requests library and set the user agent to whatever they want.

To tell the difference between the real bot and an impostor, you have to look at the source IP address. Anthropic publishes the IP addresses they use for ClaudeBot. If you see a request claiming to be ClaudeBot, but the IP address belongs to a residential proxy network, a budget hosting provider like DigitalOcean, or a server in a country where Anthropic does not operate infrastructure, you are looking at a spoofed scan.

You can verify the IP ranges directly. Anthropic hosts a JSON file containing their current IP blocks. If the incoming request does not originate from one of these prefixes, it is malicious.

How to Block Fake ClaudeBot Traffic

Relying on user agent strings for security is like letting anyone into a building just because they are wearing a nametag they wrote themselves. You need to verify their ID.

If you use Cloudflare, you can set up a WAF rule that checks both the user agent and the source IP. Cloudflare actually maintains a list of verified bots, which handles the verification process for you. You can create a rule that blocks requests claiming to be ClaudeBot if they are not verified.

For those running their own Nginx or Apache servers, you can handle this by combining user agent checks with IP whitelisting. Here is a basic conceptual example of how you might structure this in Nginx using a map block:

map `http_user_agent `is_claudebot {
    default 0;
    "~*ClaudeBot" 1;
}
 
# Then inside your server block, check the IP if it claims to be ClaudeBot

A better approach is to download Anthropic's IP list and create an allowed IP group in your firewall. If a request has the ClaudeBot user agent but does not match the IP group, drop the connection immediately.

You can automate this with a simple cron job that fetches Anthropic's IP list daily:

curl -s https://www.anthropic.com/claudebot.json | jq -r '.prefixes[]' > /etc/nginx/claudebot-ips.txt

Then, reload your firewall or web server configuration to apply the updated list. This keeps your blocks accurate without manual intervention.

The Bigger Picture of Bot Verification

This spoofing campaign is part of a larger shift in how malicious actors operate. As security tools get better at blocking generic scanning tools like Zgrab or Nmap, attackers adapt by mimicking legitimate business traffic. They hide in the noise of the modern web.

AI bots are the perfect cover. They are noisy, they request a lot of pages quickly, and webmasters are hesitant to block them for fear of losing visibility in search engines.

If you are managing any kind of web infrastructure, take a look at your access logs today. Search for "ClaudeBot" and look at the IP addresses associated with those requests. You might find that a bot you thought was just indexing your site is actually trying to break into your database.