黑客伪装ClaudeBot大规模扫描漏洞
推荐指数 55.0 NO. 018 · 2026.08.13
发布2026/08/12Score143Comments89
为什么值得看
安全监测发现有人伪造ClaudeBot等AI爬虫User-Agent进行全网漏洞扫描，AI相关爬虫流量占比过去90天上涨11%。AI工程师需紧急排查是否误封真实爬虫或漏过真实攻击。
编辑判断
这类攻击的狡猾之处在于利用了AI爬虫的"白名单惯性"——很多网站为了SEO和AI可见性，对ClaudeBot、GPTBot等放行了更宽松的WAF规则。攻击者正是钻了这个空子。
实际影响有两个层面：一是安全团队可能把真实AI爬虫误判为攻击源而封禁，损失流量和AI搜索曝光；二是更难的是从日志里区分真假爬虫，因为User-Agent本身已不可信。Cloudflare和主流WAF厂商目前主要靠IP信誉库+行为指纹做二次验证，但覆盖率参差不齐。
建议立刻做的两件事：检查你的robots.txt和WAF规则是否仅凭User-Agent放行，以及把AI爬虫流量单独接入像Agent Analytics这类能验证ASN和请求模式的工具。如果你的产品依赖AI搜索引流，现在不是一刀切封爬虫的时候，而是得升级识别逻辑。
社区反馈
意见分歧 70 条评论
核心争论：伪造AI爬虫User-Agent的漏洞扫描激增，如何有效区分真假爬虫并低成本防护
Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies).
Yeah, that's exactly what these visits are: faked user agents that fail IP verification or Web Bot Auth. What's interesting is the surge across so many websites in the last week.
There are many possibilities but one of them could be some new vuln was released and they are looking for it. That would require looking at the URL's they are requesting. Botters run their own purpose built campaigns. Do you also have a summary of URL's requested by unique counts?