GPTBot, ClaudeBot and PerplexityBot show up in your server log and they look like good news. It looks like an AI company is reading your pages. But that name is just text the visitor typed, and anyone can type it.
So we checked. From late April 2026 to early September 2026 we looked at every visit to our own sites that arrived with an AI crawler name on it. There were 43,967 of them. More than a third of the ones we could check did not come from the company they named, and those visits were not reading pages. They were looking for API keys and config files.
How the check works
Every visit to a website carries two things. One is a name the visitor picked for itself, called the user-agent. The other is the address the visit came from, its IP address. The name can say anything. The address cannot be faked, because the reply has to travel back to it.
OpenAI, Anthropic, Google, Microsoft and Perplexity each publish a public list of the addresses their own crawlers use. So the check is simple. A visit says it is ClaudeBot. You look at its address and see whether that address is on Anthropic’s list. On the list means it really is ClaudeBot. Not on the list means something else is using the name.
Google publishes a list too, and also supports a second method called a reverse DNS lookup, which asks the internet what name belongs to an address.
What we could check, and what we could not
Of the 43,967 visits, we could not check 29,196 at all. The company behind those crawler names publishes no list, so there is nothing to compare the address against. That is about two out of every three.
That left 14,771 visits we could actually check. 9,194 were real, with an address on the published list. 5,577 were not on the list for the name they used. This is a small number of websites and most of the visits came to one of them, so treat the size of the shares as rough. How the two groups behaved is the solid part.
Real visits and fake visits asked for different things
| Real | Fake | |
|---|---|---|
| Visits | 9,194 | 5,577 |
| Asked for a password, key or config file | 0 | 38.3% |
| Got an error back | 1.9% | 72.3% |
| Different pages asked for | 320 | 891 |
In five months, not one visit that passed the check asked for a .env file, a .git folder, an SSH key or an AWS credentials file. A .env file holds the secret keys a site runs on. A .git folder holds its code history. An SSH key can open a server, and an AWS credentials file can open a cloud account.
The fake visits asked for those constantly, and most of the time they got an error back because the file was not there. They were not reading pages at all. They were looking for something.
This was not one bad day either. The fake visits are spread over 78 separate days and 726 separate hours, and the busiest single day holds only 10.7 percent of them.
Which names get used the most
| Name used | Visits we could check | Not on the list | Share |
|---|---|---|---|
| Perplexity | 1,895 | 1,425 | 75.2% |
| Anthropic | 3,239 | 1,334 | 41.2% |
| OpenAI | 6,235 | 2,241 | 35.9% |
| 1,701 | 469 | 27.6% | |
| Microsoft | 1,701 | 108 | 6.3% |
Three out of four visits using Perplexity’s name were not from Perplexity’s addresses. Two things could cause that and a log line cannot tell them apart: someone else is using the name, or Perplexity is fetching from addresses it has not published. We do not know which. Cloudflare has publicly reported the second cause in detail, and its AI bot transparency tracker currently lists Perplexity as not verified. That is agreement, not proof.
Microsoft’s Bingbot, on the other hand, has been around a long time, its addresses are stable and well known, and almost everything using its name really is it.
They are hunting for AI keys
People have been scanning the web for .env files for years. That part is old news and it did not surprise us. The rest of the list did.
We found 32 different file paths in our logs that are requests for AI developer keys and settings. That is 180 requests over 25 days, every one of them from visits that failed the check and none from visits that passed. The most requested one came in 37 times, on 19 different days.
/.config/anthropic/credentials/default.json
/.mcp.json
/.claude.json
/.cursor/mcp.json
/.claude/settings.json
/claude_desktop_config.json
/.openai/config.json
/.vscode/mcp.jsonThese files sit on a developer’s own machine. They hold API keys, and they hold MCP server settings, MCP being the way AI tools connect to other programs. Most of them did not exist two years ago. Our reading is that someone read the help pages for these tools, put the paths into a scanner, and pointed it at the web using ClaudeBot’s name. It is careful work, and that is the part that bothers us.
Some of the same visits put /@fs/ in front of those paths. Vite is a tool developers use while they build a site, running it on their own computer, and /@fs/ is how Vite serves files from that computer. So the scan is looking for anyone who left that server open to the internet. Every one of those requests got a 404 from us.
Almost nobody checks the name
Cloudflare Radar’s most recent scan covered the top 200,000 websites, and 106,252 of them gave a usable answer. 83 percent have a robots.txt file, which is a public note asking visitors to follow some rules. 80 percent have rules in it aimed at AI crawlers. And 0.06 percent use Web Bot Auth, a newer method where the crawler signs each request with a secret key only it holds, so the website can prove who sent it instead of trusting a name.
So almost everyone writes rules addressed to AI crawlers by name, and almost nobody checks the name. robots.txt asks a visitor to say who it is, and nothing in it checks the answer.
Cloudflare said as much when it added signed requests to its verified bots program. The older way of checking uses a block of addresses plus the user-agent header, and both have problems. Address ranges get shared and they change, and the header is, in Cloudflare’s words, “easily spoofable”. That is the method we used, described by the people who built the replacement for it.
How to run the same check
Take one day of access logs, keep the visits whose user-agent contains a crawler name, and check each address against the public list. These are the files:
openai.com/gptbot.json
openai.com/searchbot.json
openai.com/chatgpt-user.json
claude.com/crawling/bots.json
perplexity.ai/perplexitybot.json
perplexity.ai/perplexity-user.json
bing.com/toolbox/bingbot.jsonGoogle’s method takes two steps. Run a reverse DNS lookup on the address and check that the name ends in googlebot.com, google.com or googleusercontent.com. Then look that name up again in the normal direction and check that it gives back the same address. The first step alone can be faked, which is why Google asks for the second.
Then compare what each group asked for, rather than how many visits each made. The count tells you very little. The list of files is where the difference shows.
Two things this changes
If you count AI crawler visits to judge how much the assistants care about your site, that count is too high, and how much too high depends on which names you are counting.
And if a leftover .env file or an open development server is possible on your setup, the traffic hunting for it is arriving right now, under a name your logs probably treat as friendly.
