Is this Googlebot real?
Enter an IP address and the crawler it claims to be. We check it against the address list that crawler's owner publishes, then reverse DNS, and tell you whether it's genuine.
Which crawlers can be checked
| Crawler | Run by | How we check |
|---|---|---|
| Googlebot | Published address list | |
| Bingbot | Microsoft | Published address list |
| Applebot | Apple | Published address list |
| GPTBot, ChatGPT, OpenAI search | OpenAI | Published address lists |
| PerplexityBot, Perplexity | Perplexity | Published address lists |
| YandexBot, Baiduspider | Yandex, Baidu | Reverse DNS, both ways |
| ClaudeBot | Anthropic | No address list or DNS name to check yet: we show which network the address belongs to |
If the address turns out to belong to a different crawler, or to a cloud server, the result says so.
Checking Googlebot by hand
Google describes two ways to verify its crawlers. You can check the address against the IP ranges it publishes for Googlebot, or use DNS:
# 1. Reverse lookup: the name should end in
# googlebot.com, google.com or googleusercontent.com
host 66.249.66.1
1.66.249.66.in-addr.arpa domain name pointer crawl-66-249-66-1.googlebot.com.
# 2. Forward lookup: must return the same address
host crawl-66-249-66-1.googlebot.com
crawl-66-249-66-1.googlebot.com has address 66.249.66.1Both steps matter. Anyone who controls an address can make its reverse lookup say "googlebot.com", but only Google can make googlebot.com point back to it.
Why fakes are worth catching
Sites often wave Googlebot past rate limits and firewalls, so scanners borrow its name. When we checked our own sites, 1 in 6 "Googlebots" was fake, and more than half of the requests claiming to be ChatGPT were too. They came from rented cloud servers and went straight for secret files like .env. A real crawler reads your pages. A fake one is looking for a way in.
To check every request instead of one address at a time, paste a sample of your access log.
Questions
How does Google say to verify Googlebot?
Two ways: check the address against the IP ranges Google publishes for its crawlers, or do a reverse DNS lookup (the name should end in googlebot.com, google.com or googleusercontent.com) and then a forward lookup of that name, which must return the same address. This check does both.
Why would anyone fake Googlebot?
Many sites let Googlebot past rate limits and firewalls, so scrapers and scanners borrow its name. On our own sites, 1 in 6 requests claiming to be Googlebot was fake, mostly from rented cloud servers looking for secret files.
Should I block fake crawlers?
Yes. A request that lies about who it is has no reason to be trusted. Block by behaviour or by the address it came from, not by the name it claims, so the real crawler is never caught.
Where do I find the address to check?
In your server's access log (the first field on each line), your firewall or your CDN's logs. If your site is behind Cloudflare, look for the CF-Connecting-IP header: the address in the log may be Cloudflare's own.
More free tools
AI crawler checker
See which AI crawlers and search engines your robots.txt lets in, and what else anyone can see from outside.
Free toolAccess log analyzer
Paste lines from your nginx or Apache log and see people, crawlers, fakes and attacks, sorted in seconds.
Related reading
1 in 6 'Googlebots' on our sites was fake
Fake Googlebot, GPTBot and ChatGPT requests came from rented cloud servers, hunting for .env files. How to tell a real crawler from a fake in one minute.
SecurityBots asked our sites for .env files 11,769 times
689 different paths, all five of our sites, 785 requests a day. What the scanners hunt for, who sends them, and how to check your own site in two minutes.