A "Claude" came looking for my .env file. Its IP was not on Anthropic's list

In October 2026 my lab site received 69 requests calling themselves Claude-User from IP addresses outside the ranges Anthropic publishes, and 68 of them were hunting for .env and .git files. An AI bot's name in a User-Agent is not an identity; only an IP address that matches the vendor's published list, or a signature, is.

Evidence level: Lab observation

A "Claude" looking for .env

On 22 October 2026 I went back through the logs of pw.migurei.ai from the start of the month. I filtered for requests probing for sensitive files: .env, .git, info.php, the kind of files that hold passwords or configuration and should never be public.

I expected anonymous scanners. What I found was "Claude".

Claude-User is the name Anthropic uses when Claude opens a page because a user asked it to. On pw, between 1 and 22 October, 69 requests carried that name from IP addresses that are not on Anthropic's published list. 68 of them probed for .env and .git, all from a single source, over about a day on 16 and 17 October. Every one got a 404.

By contrast, every request on pw that claimed to be a crawler from OpenAI, Google, Bing or Perplexity did come from that company's published IP ranges.

Much more on the main site

On migurei.ai, between 7 and 21 October, there were 12,801 probing requests. None of them got a real page back: zero 2xx responses. More than 3,000 carried the name of a bot on the list I track, around 30 different names.

One source, at about 14:40 Tokyo time on 21 October, sent 200 requests in roughly two minutes, cycling through 13 different AI bot names. 175 of them got a 404.

The bot name told me nothing about who was sending. It is just a string anyone can type.

What to do with your site

If your firewall lets AI bots through by name, it lets through anyone who borrows that name. Verify by IP instead: OpenAI, Google, Bing, Perplexity and Anthropic all publish the ranges their bots use.
If you count AI bot visits, separate real bots (matching IP) from bot names. Otherwise probes like these inflate your AI traffic.
Make sure .env, .git and configuration files are never served. On my two sites, no probe has got through.

How sure is this

This is a lab observation on our own two sites, not yet independently checked.

An IP outside the published list is not proof of a fake; the list I compared against may have been out of date. On migurei.ai the server log mostly records Cloudflare's edge addresses rather than the visitor's, so the IP check there is weaker than on pw. Nor does any of this show a file was exposed: 12,801 probes, zero successes. Someone is trying the doors, but nothing has been lost.

Sources

This is an observation from our own lab; the raw data is not published here.

What this does not prove

An IP outside the published list is not proof of a fake: the list compared against may have been out of date.

On migurei.ai the server log mostly records Cloudflare edge addresses, so the IP check there is weaker than on pw.

This does not show that any file was exposed: no probe got a real page back.