3,188 Fake Anthropic Domains and the ClaudeBot That Never Was

Anthropic doesn't publish official IP ranges for ClaudeBot. That single omission is apparently all attackers needed.

In November 2025, Radware's threat intelligence team announced something that should embarrass every bot-detection vendor still selling User-Agent filtering as a security feature: actors are actively developing and deploying bots that impersonate AI agents from OpenAI, Google, Grok, and Anthropic. Not testing. Not probing. Deploying. Radware said it holds this assessment with high confidence, which in threat-intel speak means "we're not guessing anymore."

Here's the part that should make every backend engineer wince: a User-Agent string is a self-reported label. It's the HTTP equivalent of writing "IRS Agent" on a name tag and walking into a building. Anthropic doesn't publish IP ranges to verify against, so there's no second factor to catch the lie. Radware's advice is blunt:

That's not a suggestion. That's an admission that an entire generation of bot-management products built around header inspection is now functionally decorative.

Why this matters more now than it did a year ago

AI agent modes increasingly need POST request permissions — the ability to actually do things on the web, not just read it. That's a wider attack surface by design. An agent that can browse is annoying to fake. An agent that can submit forms, log into accounts, and interact with authenticated endpoints is a golden disguise for account takeover and financial fraud, which is exactly what Radware flagged as the practical endgame here.

And this isn't happening in a vacuum. Anthropic has published multiple misuse disclosures — March 2025, August 2025 — showing it already tracks abuse of Claude as a routine cost of doing business. In September 2025 it went further, disclosing that Claude Code had been hijacked in a state-linked espionage campaign, which Anthropic described as the first documented large-scale cyberattack executed without substantial human intervention. Read that twice. The bot-spoofing story and the autonomous-espionage story are cousins, not coincidences.

What Nobody Is Talking About

Everyone's focused on the scanning bots. Almost nobody is talking about the domain economy building around AI brand trust. BforeAI counted 3,188 abusive domains registered in six weeks in 2026, impersonating Anthropic's Mythos branding to lure developers into fake tools and credential-harvesting portals. Meanwhile, a self-described autonomous account nicknamed "hackerbot-claw" claimed to have scanned 47,391 GitHub repositories, compromising several by abusing Actions workflows. Separately, Bitsight found more than 30,000 exposed OpenClaw instances sitting on the open internet — agent control planes with stored tokens, sometimes with no meaningful auth in front of them.

That's the real story: AI brand equity is now a security liability. Anthropic's name is valuable enough that attackers register thousands of lookalike domains around it, the way they used to squat on bank names. Trust in "Claude" or "ClaudeBot" is worth stealing because legitimate sites increasingly whitelist it.

So what do you actually do? A short list, because this isn't complicated:

1. Stop trusting User-Agent strings as identity — verify via DNS/IP where possible.

2. Treat any AI agent with POST access as a privileged client requiring scoped permissions and rate limits.

3. Sanitize retrieval pipelines against prompt injection hidden in HTML comments or repo metadata.

4. Lock down GitHub Actions secrets and audit workflow permissions like you would production credentials.

5. Assume any internet-facing agent dashboard is already being scanned — because it is.

AI vendors built brand trust as a feature. Attackers just found the invoice.