Half of Visits Claiming to Be Claude-User Were Spoofed: Analysis of 63 AI Bot Log Entries
Published
This article was first published in Korean by Intrix Lab on September 1, 2026.
Measurements on 2026-09-01 showed that 32 of 63 visits to intrix.kr claiming to be Claude-User, or 50.8%, were spoofed. Of 247 visits claiming to be GPTBot, 24, or 9.7%, were also spoofed. Counting AI bot visits solely by User-Agent strings can produce figures that overstate actual AI traffic and demand.
If you see Claude-User in bot logs, half could be fake
In this study, requests claiming to be Claude-User included both requests from the actual operator's network ranges and requests from external parties merely copying the name. By name alone, they all looked like the same bot. Checking the originating network revealed that 32 of 63 requests came from outside the official ranges.
In this article, fake means a request that claimed the name of an AI bot but did not actually come from that bot's operator.
What is a spoofed bot?
User-Agent, or UA, is the name a program sending a request gives itself. It can contain a string such as Claude-User or GPTBot, but the name itself does not prove identity. It is closer to a self-introduction that anyone can copy.
A spoofed bot is a request that uses a known AI bot's UA but originates outside its official network ranges. Grouping logs by name alone counts these requests as legitimate visits from the AI operator.
This count is conservative. Only requests confirmed to be unrelated to the operator were counted as spoofed, so actual spoofing may be more widespread.
What did the measurements show?
| Claimed bot identity | Total visits | Spoofed | Spoofing rate |
|---|---|---|---|
| ClaudeBot | 1,233 | 47 | 3.8% |
| ChatGPT-User | 708 | 13 | 1.8% |
| PerplexityBot | 492 | 15 | 3.0% |
| GPTBot | 247 | 24 | 9.7% |
| Claude-User | 63 | 32 | 50.8% |
The period runs from 2026-05-28 through 2026-09-01, and the population consists of bot logs from a single site, intrix.kr. Among organizations from which spoofed Claude-family requests originated, Google Cloud accounted for a concentration of 75 requests. Originating from a cloud service does not by itself indicate spoofing. Only requests confirmed to be unrelated to the operator were counted as spoofed.
Why is this a problem?
Counting visits by UA alone mixes impersonation requests from external parties with legitimate AI bot visits. Using that number as a proxy for AI traffic or user demand produces inflated reports. UAs that appear to belong to bots opening pages in response to user requests are especially easy to mistake for demand signals.
UA alone is therefore insufficient for counting visits. Request counts by bot name and counts of requests that passed verification need to be kept separate, so visits identified only by name are not treated as equivalent to verified visits.
How far do these findings apply?
These spoofing rates come from a single site, intrix.kr. They cannot be generalized to sites of different sizes or in different industries. These data also cannot establish changes outside the study period.
The spoofing rates describe the actions of external parties impersonating the bots. They do not mean that the operators of Claude-User or GPTBot engaged in spoofing or had operational problems. They should not be read as a ranking of operators by spoofing rate.
What should site operators do first?
Bot visits in server or CDN logs should not be counted by name alone. Keep a separate count of requests verified as actually coming from the operator. It is safer to include only verified visits in reports of AI traffic or demand.
The free SEO and GEO audit can help you first check your site's bot access conditions. Bot demand metrics should be counted separately using verified values, rather than mixed with audit results.
Frequently asked questions (FAQ)
Q. Can User-Agent alone verify AI bot visits?
No. Anyone can use the same UA string, so you need to check separately whether the request actually came from the operator.
Q. Does the 50.8% Claude-User spoofing rate indicate a problem with the operator?
No. This figure is the share of requests from external parties impersonating Claude-User. It does not mean the bot operator engaged in spoofing.