LSN โ€” Local Sovereign Network

The Newest Trust: Fake AI Crawlers and the Frontier of Verification

TI-2026-086E ยท Series: The Wardrobe ยท Case 5 ยท Classification: HIGH ยท Confidence: HIGH (per-claim; one bounded item noted)

The four previous cases undressed costumes with decades of reputation behind them โ€” Google, the Internet Archive, Baidu, Yandex. This case reaches for the coats that did not exist two years ago: the AI crawlers. ClaudeBot, GPTBot, ChatGPT-User โ€” names operators only recently added to their allowlists, in the scramble The Training Land-Grab (085A) documented. A freshly-granted trust is an under-defended trust, and this case is where the series tests its own method against the hardest material: masks whose real owners live on the same shared clouds the impostors rent. The finding is not that these masks are unverifiable. It is that they are verifiable exactly as far as someone has done the work of writing down where the real crawler lives โ€” and no further.

Executive Summary

Three AI-crawler costumes appear on the wardrobe rack, and they behave nothing like the crisp search fleets:

At first read the AI masks look like a place the method might break: a ClaudeBot on AWS carries an "ISP: Anthropic, PBC" attribution, and Anthropic really does run on AWS, so is this a real crawler we are about to wrongly convict? The answer โ€” and it is the point of the case โ€” is no, and the reason it is no is the classifier's curated service list. The taxonomy verifies ClaudeBot against AS399358, Anthropic's own autonomous system, not against AWS. So a ClaudeBot on AS16509 is outside Anthropic's published home and correctly reads SPOOFED โ€” a verdict the live classifier confirms. The misleading "Anthropic" ISP string never enters the decision, because the verifier checks where the operator says its crawler lives, not what a geolocation feed guesses.

That resolves the frontier in the right direction and exposes the real one. The AI class splits cleanly in two:

The frontier of un-verifiability is not "AI." It is "operators who publish no ranges." That is where an impostor's alibi becomes permanent.

Why AI Is the Newest Trust

Every mask in the first four cases exploited a trust built over fifteen or twenty years. The AI-crawler mask exploits a trust built since roughly 2024. When large-language-model crawlers arrived โ€” GPTBot to gather training data, ChatGPT-User to fetch a page a user asked about, ClaudeBot for Anthropic's equivalents โ€” operators had to make a fast decision they had never faced before: allow these, to be cited and indexed by AI, or block them, to resist training? Case 085A, The Training Land-Grab, documented exactly that scramble, and verified the real GPTBot in the process.

Either choice creates attack surface. Allow them, and you have added new names to your allowlist. Block them, and you have added new names to a policy path attackers can probe. Either way, ClaudeBot, GPTBot, and ChatGPT-User became decision-bearing identities on the modern edge in the space of about a year โ€” and a decision-bearing identity is worth forging. The AI masks are the newest coats on the rack because the trust they spend is the newest trust there is, and the verification habits around them are correspondingly immature: nobody has a decade of intuition for what ClaudeBot should and shouldn't do.

That immaturity is real, and it is why this case demanded more caution than the others. It is also why the answer, when it came, came from the one place that had done the homework: the classifier.

The Apparent Trap: A ClaudeBot on Anthropic's Cloud

Member 216.73.216.198 presents the hardest instance in the whole series. It claims to be ClaudeBot. It runs vhost_enum โ€” guessing AI-service subdomains like lsn-ai-comfyui โ€” with ninety-eight requests, steady cadence, and it is CrowdSec/MikroTik banned. So far, ordinary. But its enrichment is not ordinary:

Read naively, those signals conflict, and the conflict is dangerous. Anthropic genuinely runs on AWS. If you built a verifier that trusted the "Anthropic" ISP string, you would false-verify this hostile scanner into a real crawler โ€” laundering an attacker into your allowlist. If you built one that trusted the "Amazon" ARIN registration, you might false-spoof a genuine Anthropic crawler that happened to egress a shared AWS block. This is the exact two-sided hazard the series has been circling: shared-hyperscaler space is where both errors live.

The classifier does not fall into either trap, and it is worth being precise about why, because it is the answer to how you verify anything on a shared cloud.

How the Classifier Builds the Confidence

The agent taxonomy does not verify ClaudeBot by asking "does this IP smell like Anthropic?" It verifies against a specific, curated fact: Anthropic's own published autonomous system. The custom rule reads, in the taxonomy's own notation:

#2367  anthropic/ClaudeBot (training)  verify[asns=[399358] cidrs=1]

AS399358 is Anthropic's ASN โ€” the network Anthropic operates and from which the real ClaudeBot egresses. That is the discriminator. Run the ambiguous IP through the live classifier and the verdict is unambiguous:

wt_agents_test(ClaudeBot, ip=216.73.216.198, asn=16509)
    โ†’ anthropic/ClaudeBot ยท confidence = SPOOFED

216.73.216.198 is announced by AS16509 (Amazon), which is not AS399358 (Anthropic). The IP is outside the operator's published home, so the ClaudeBot claim is checked and contradicted โ€” SPOOFED, in the precise 085 sense, not "unverifiable." The ISP: Anthropic, PBC string never touches the decision, because the verifier was built to ignore exactly that kind of noisy attribution and consult the operator's declared ASN instead. The misleading label is the trap; the curated ASN list is the way out of it.

The same authority convicts the others:

wt_agents_test(ChatGPT-User, ip=104.23.245.63, asn=13335)  โ†’ SPOOFED
    ( OpenAI publishes AS394699 + 266 CIDRs; Cloudflare AS13335 is neither )
wt_agents_test(ClaudeBot,     ip=96.44.160.195, asn=36352)  โ†’ SPOOFED
    ( ColoCrossing is not Anthropic's AS399358 )

OpenAI's user-fetch agent egresses AS394699 and 266 published CIDRs; a ChatGPT-User arriving from Cloudflare's edge (104.23.245.63, 172.71.126.234, credential_harvest, banned) is a Cloudflare Worker or WARP tunnel, not OpenAI. A ClaudeBot from ColoCrossing โ€” a US budget host we met in 066B โ€” is not Anthropic. Both are clean forgeries, and both are convicted not by intuition but by the published-range list the classifier holds.

This is the case's central lesson, and it is a constructive one after four cases of "the mask is a lie": the confidence is exactly as good as the service list. Where the operator publishes a home ASN and someone curates it into the taxonomy, the mask can be convicted with certainty, on a shared cloud, through misleading enrichment. That is the machinery working as designed.

The Real Frontier: The Bots That Publish Nothing

If verifiable operators can be defended, the genuine frontier is the operators who give you nothing to verify against. The taxonomy is honest about them. A large fraction of the AI class is marked NO-VERIFIER(claimed-only):

anthropic/Claude-User        โ€” NO-VERIFIER (claimed-only)
anthropic/anthropic-ai (blt) โ€” NO-VERIFIER (claimed-only)
perplexity/PerplexityBot(blt)โ€” NO-VERIFIER (claimed-only)
common-crawl/CCBot           โ€” NO-VERIFIER (claimed-only)
bytedance/Bytespider         โ€” NO-VERIFIER (claimed-only)
cohere/cohere-ai             โ€” NO-VERIFIER (claimed-only)
diffbot/Diffbot, YouBot, AI2Bot, Timpibot, Omgilibot โ€ฆ

For every name on that list there is no discriminator to fail. The operator publishes no fetchable egress range, or runs distributed/peer-to-peer, or (like Bytespider) simply does not offer a verification method. So a request claiming to be Claude-User or CCBot can only ever be filed CLAIMED โ€” "no check possible" โ€” never SPOOFED. An impostor wearing one of these names holds a permanent alibi: you cannot prove it is lying, because the real owner never said where the truth lives.

That is the frontier, and it is a policy frontier, not a technical one. The AI-crawler ecosystem is bimodal. On one side are operators โ€” OpenAI, Anthropic, Google (Google-Extended's 1,637 CIDRs), Apple, Meta, DuckDuckGo โ€” who publish ranges and can therefore have their identities defended by anyone who curates the list. On the other are operators who publish nothing and thereby hand every impostor their good name for free. The most forgeable AI masks are the ones whose real owners are the most opaque. If you want your crawler's name to stop being a costume, publish where it lives.

A Note on Data Hygiene: The GPTBot Count

Forensic honesty requires one more caveat, and it is about our own data. When the Fake-GPTBot fleet (AS14061, DigitalOcean) is expanded to members, the IPs returned fall in 203.0.113.0/24 โ€” which is RFC 5737 TEST-NET-3, a range reserved for documentation and never routed on the public internet. Combined with the fleet's one-request-per-IP profile and an effective bad-rate of 0.0, that is the signature of synthetic or seed records, not organic attacker traffic.

So this dossier makes no IP-level claims about the GPTBot fleet and treats its headline size as unreliable pending clean data. This is not a defect to hide; it is the same discipline the case argues for applied to ourselves. A fleet-size number is only as trustworthy as the realness of the members underneath it, and where the members are documentation IPs, the honest move is to say so and set the figure aside. (The GPTBot verifier is sound โ€” AS394699 + 21 CIDRs; it is the observed member data here that is contaminated.)

Steelmanning: "You are still just trusting the classifier's list"

The fair objection: the whole verdict rests on the taxonomy's claim that Anthropic is AS399358 and OpenAI is AS394699. If those curated facts are wrong or stale, the convictions are wrong. Isn't this just moving the trust, not removing it?

Yes โ€” and that is the correct and honest shape of the answer. Verification is never trust-free; it relocates trust from an unauthenticated header (the User-Agent, which anyone can type) to an authenticated, operator-published fact (the egress ASN/CIDR, which only the operator controls and which is checkable against RIR data). That relocation is the entire value. The header trust is worthless because it is free to forge; the ASN trust is worth something because the operator had to announce those ranges through BGP and register them. The residual risk is curation staleness โ€” an operator changes ASN and the list lags โ€” which the roadmap already tracks as a maintenance hazard, and which is precisely why the NO-VERIFIER bots are marked as such rather than guessed at. The method does not eliminate trust; it moves it to the one place an impostor cannot cheaply reach, and it declares where it could not move it at all. That declaration โ€” the claimed-only flag โ€” is the honesty that keeps the confidence calibrated.

What Holds, and What Is Bounded

Documented, HIGH confidence: the three verifiable convictions (ClaudeBot on AWS and ColoCrossing, ChatGPT-User on Cloudflare) via the classifier's operator-ASN authority; the taxonomy's verify lists (Anthropic AS399358, OpenAI AS394699 + CIDRs); the large NO-VERIFIER claimed-only set as the true un-convictable frontier; the RFC 5737 contamination in the GPTBot member data.

Bounded: the organic prevalence of these AI-mask fleets. Because one fleet's member data is synthetic and the others are small (single- and low-double-digit request counts), this case does not assert the AI masks are as voluminous as the GCP search fleets โ€” only that they are present, convictable where verifiable, and structurally the newest and most policy-dependent corner of the wardrobe. Volume is a question for cleaner data.

Why It Matters

The AI crawlers were the case most likely to break the method, and instead they sharpened it. They showed that verification on a shared cloud is not hopeless โ€” a ClaudeBot on AWS, wearing an "Anthropic" ISP label, was convicted with certainty โ€” provided the classifier holds the operator's real published home. The confidence did not come from cleverness at request time; it came from curation done in advance: someone wrote down that Anthropic is AS399358, and that single curated fact cut through every misleading signal around it.

And the cases turned the definition of "unverifiable" inside out. The frontier is not the AI class; it is the opaque operators within it โ€” the claimed-only names whose owners publish nothing and so lend their reputation to every forger permanently. That reframes a defensive to-do into a request to the industry: an AI operator that publishes its egress ranges is not just being tidy; it is denying impostors its own good name. The newest trust can be defended โ€” but only for the operators willing to say, in a form a machine can check, where their crawler actually lives.

Cross-references

Next in the series โ€” TI-2026-086F, The Social Unfurlers: Fake-Twitterbot, facebookexternalhit and Feedfetcher โ€” the preview-and-feed masks that trade on being harmless.

TLP:WHITE. Attacker infrastructure only; Anthropic and OpenAI are named as impersonation victims and as operators whose published ranges enable defence. No internal addresses, credentials, or PII disclosed. Verdicts calibrated per claim; one prevalence item explicitly bounded.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 5 / 26 Next โ†’