A year ago the question about this corpus was whether anyone read it. Then TI-2026-065C asked a sharper version — whether the actors read it, whether the operators documented here return to see what has been written about them — and answered no. Three tests, a negative result, published specifically so that a cheap and unfalsifiable sentence could not be written: "the threat actor was observed monitoring published analysis of its operations."

That closed one door and left another open. If not the actors, then who?

Eight weeks of perimeter logs answer it, and the answer is not a person.

19,494 requests carrying AI-agent identities. 918 published dossiers successfully served to them.

The census

Between 2026-06-03 and 2026-07-28, nineteen distinct AI-agent identities arrived. Ranked by volume:

Filtered to successful retrievals of /threat-intel/*: 918 dossier pages served. The index itself was fetched 44 times. Individual investigations were retrieved by name — The Backbone (023B) 28 times, National Intelligence Law (045G) 7, The Wrapper (031A) 7, The OmegaTech Empire (024C) 7, The M247 Empire (036B) 6, Lithuanian Connection (026N) 5, U Is For Unpatched (071U) 5, MevSpace (025B) 4.

This is not incidental crawling. Something is reading the work, by name, and returning for more.

The number that means people

One row in that table behaves differently from the rest, and it is the one that matters.

ChatGPT-User: 914 requests from 459 distinct addresses.

That identity is not emitted during autonomous crawling. It fires when a person asks an assistant to fetch a specific URL. The mean is 1.99 requests per source address — the shape of many separate people each pointing a tool at a page or two.

Compare the autonomous crawlers, which concentrate volume on few addresses: GPTBot averages 17.5 requests per IP, Amazonbot 10.6. The ratio is the discriminator, and it converts an abstraction into a count.

Several hundred separate people directed an assistant at this corpus in eight weeks.

Not one crawler with a large budget. Hundreds of individual acts of curiosity, each mediated by a machine. That is a readership. It is simply not a readership that arrives by typing an address into a browser.

The same names, worn by hunters

Here the picture turns, because the identity namespace delivering those readers is simultaneously the most-worn costume on the perimeter.

Wearing a crawler's name is not new; it has been documented here repeatedly. What is new is what the wearers are looking for.

/.anthropic/config.json          /.claude.json
/.openai/config.json             /.clauderc
/.claude/settings.json           /.claude/settings.local.json
/.claude/.settings.local.json    /.claude/settings.local.txt
/.claude/claude.json             /.claude/claude.config.js
/.config/anthropic/credentials/default.json
/.cursor/mcp.json

These paths exist for exactly one reason: they are where Claude Code, Claude Desktop and Cursor persist API keys and MCP server definitions on a developer's machine. Their presence in commodity scan wordlists means the scanning economy has added AI developer tooling to the same artifact class as /.env, /.aws/credentials and /.docker/config.json.

The precondition being exploited is old and boring: a developer deploys a home directory or a repository that still contains their tool configuration. It is the accident that made .env harvesting profitable, applied to a newer file.

The systematic operator is AS22295, Advin Services LLC — 133 addresses, 9,636 requests, effective_bad_rate 0.743, 72 of 133 addresses classed aggressive. Its signature is a paired probe:

2026-06-10 10:25:15.055 UTC  207.241.173.236  GET /.anthropic/config.json
2026-06-10 10:25:15.072 UTC  207.241.173.236  GET /.openai/config.json

Seventeen milliseconds apart. Both vendors, every time, from a single address, repeated across three separate /24s.

And the institutional record does not match the conduct. PeeringDB carries Advin's own entry — advin-servers-as22295, website advinservers.com, Open peering policy, 250 IPv4 prefixes — with a self-declared info_type of Cable/DSL/ISP. That describes a residential access network. One hundred and thirty-three datacenter addresses running synchronized credential dictionaries are not residential access traffic. The description is the operator's own, filed by the operator, and it is wrong.

The costume and the target are the same brand. AS22295 presented the ClaudeBot identity on one address for 42 requests, with the provenance check failed. ChatGPT-User was recorded spoofed from Hetzner AS24940 and from three Cloudflare addresses, all with probe_intent=credential_harvest. The name is worn to get past filters; the keys behind that same name are the prize.

Nothing was served

No configuration file was ever disclosed. The complete path inventory for /.anthropic/*, /.openai/*, /.claude* and /.cursor/* resolves to 404 (absent), 403 (catch-all or CrowdSec) and 301/302 (redirect or forward-auth interception).

A subset arrived as decoded forward-auth redirect targets — probes aimed at authenticated subdomains, intercepted before reaching any backend. Enforcement corroborates: 16 AS22295 addresses in router blocklists, and 208.84.100.215 under a continuously re-issued http:scan ban through 2026-07-28 with durations of 143–165 hours.

The defence that held is identity-independent. The catch-all does not care what the User-Agent claims. That is precisely why it works against a namespace where most claims cannot be checked at all — which is the next finding, and the uncomfortable one.

Verification is not hard. It is mostly absent.

Of 31 AI identities in the agent taxonomy, fourteen carry no verifier whatsoever:

Claude-User · Claude-SearchBot · anthropic-ai · PerplexityBot · CCBot · Bytespider · cohere-ai · Diffbot · PetalBot · Timpibot · ImagesiftBot · YouBot · AI2Bot · Omgilibot

For each, the User-Agent is an assertion with nothing behind it. No published range, no ASN, no reverse-DNS pattern. No verdict beyond claimed is reachable. These agents can be neither confirmed nor caught.

Where verifiers do exist they are vendor-published CIDR lists — GPTBot 21 ranges, OAI-SearchBot 35, ChatGPT-User 286, Google-Extended 1,639, DuckAssistBot 481, Amazonbot by reverse-DNS suffix. Verifiability is a choice each vendor makes unilaterally, and most have not made it.

A site operator cannot distinguish a polite reader from an impostor for the majority of agents knocking on the door.

Two negative results

This investigation produced two failures worth more than its successes, and both are recorded because a method that hides its errors is not a method.

The verifier was wrong for a reason nobody had checked — and the first repair was reverted for the wrong reason.

Rules #2367/#2368/#2369 verified ClaudeBot against AS399358 and 160.79.104.0/23. They returned spoofed for traffic from 216.73.216.0/22, an ARIN reassignment carrying NetName AWS-ANTHROPIC and abuse contact arin@anthropic.com, announced by Amazon's AS16509.

The CIDR was added, then reverted on the grounds that RIR allocation is not published egress and the authoritative list could not be found — docs.claude.com/ip-ranges.json answers HTTP 200 with a documentation shell, a soft-404, and the obvious endpoints 404.

The list exists. It is published at claude.com/crawling/bots.json, and 216.73.216.0/22 is its first entry:

{ "creationTime": "2026-05-01T20:46:04Z",
  "prefixes": [ {"ipv4Prefix": "216.73.216.0/22"},
                {"ipv4Prefix": "34.162.230.222/32"}, ... ] }

Twenty prefixes: one /22 and nineteen /32s in Google Cloud. The revert was over-cautious, and the caution came from failing to find a document rather than from the document saying anything.

Worse, the range that was in the rule is not a crawler range at all. Anthropic's platform documentation lists 160.79.104.0/23 as the inbound API endpoint — where Anthropic receives connections — with 160.79.104.0/21 for outbound API tool calls. Someone had configured a crawler verifier with an API firewall range. It could never have matched crawler traffic, so the rule was structurally incapable of returning verified for the thing it was written to verify.

Corrected against the published feed, the split is unambiguous: 32 addresses verified across 249 requests, 31 spoofed across 154 — and every one of the 84 credential probes belongs to the spoofed side.

This overturns a published finding, including one of ours.

TI-2026-089I identified a Fake-ClaudeBot fleet of 23 addresses inside 216.73.217.0/24 on Amazon. That /24 sits inside the published 216.73.216.0/22. Those 23 addresses were the genuine ClaudeBot.

The error was not carelessness; it was a reasonable premise that happens to be false. 089I reasoned that the real crawlers egress from their operators' own published ranges and do not "rent AWS instances to crawl from" — so an AWS address announcing itself as ClaudeBot must be an impostor. For Google and OpenAI that inference holds. For Anthropic it is exactly inverted: their published crawler prefix is AWS-announced space, a reassignment inside Amazon's parent block.

The rest of 089I is unaffected. Fake-Googlebot at 74 and Fake-ChatGPT-User at 7 rest on the same logic applied to operators for whom it is sound — Google's published Googlebot ranges are not GCP tenant space, and OpenAI's are not Cloudflare. Only the ClaudeBot fleet inherits the bad premise, and the roster drops from roughly 160 forged addresses to roughly 137.

The lesson is narrower and more useful than "verify identities": an allocation's announcing ASN says nothing about whose traffic it carries. A vendor can and does run published crawler infrastructure inside a hyperscaler's address space. Reasoning from "it came from AWS, therefore it is not the vendor" is a category error, and it produced a confident published verdict against a legitimate visitor.

The investigation forged the identity it was investigating.

At 2026-07-28 19:37:49–50 local, seven requests carrying the ClaudeBot User-Agent reached the perimeter from an internal workstation address, fetching /robots.txt, /threat-intel/, both sitemaps, /llms.txt, a named dossier and /threat-intel.html.

They were not Anthropic. They were curl invocations issued during this analysis, checking whether those paths served to a crawler's view, with the User-Agent supplied on the command line.

The impersonation took one flag. It appears in the access log indistinguishable, at the User-Agent layer, from the identity it copied. Those rows are documented here so they can be excluded from agent statistics for that date.

It is also the thesis, demonstrated rather than argued. If an identity can be assumed accidentally, in passing, by a process auditing that very impersonation — then the User-Agent string carries no evidentiary weight at all, and every conclusion in this domain must rest on network provenance alone.

What if the readership is the point

Steelman the comfortable reading: this is success. The work was published to be found; it is being found. Nineteen thousand agent requests and 918 dossiers served is reach that no independent researcher achieves by other means. Several hundred people asked a machine about this material. That is the corpus doing its job.

The evidence mostly supports that. It does not fully.

A corpus built on [DOCUMENTED] versus [INFERRED] tags, calibrated confidence, and a source_url behind every claim has those properties because they are the point. They are what makes it checkable, and checkability is the only thing separating this from assertion.

Machine readership propagates the claims. It does not reliably propagate the calibration. A finding written as medium confidence, circumstantial, one source can re-emerge downstream as a flat statement of fact with no citation and no way back to the qualifier. The work travels further and arrives thinner.

That is not an argument against being read. It is an argument for writing as though the qualifier will be stripped — putting the uncertainty in the sentence rather than only in the metadata, so that what survives the journey still tells the truth about how much is known.

The readers arrived. They are not who anyone expected, they mostly cannot prove who they are, and some of them are wearing each other's names to steal each other's keys.

The right response is the one already in place: verify what can be verified, refuse by default what cannot, and never let a name do the work of a proof.