言語

Bot Verifier

Free, no signup. Anything can put "Googlebot" in a user-agent string — the IP address is what actually tells you who's crawling. Paste it in and get a verdict from two independent methods: the operator's published IP ranges and forward-confirmed reverse DNS (FCrDNS). If it's a fake, you'll see who the IP really belongs to.

Built by Patrick Stox

Crawler lists updated 34 days ago.

Pick the bot the user-agent string claims — spoof detection only runs when there's a claim to test. Try it with a real one: — fills the form; press Verify to run the check (checks are rate-limited).

Example data — replace with your own, then press Verify

Checks run from our server; we fetch the URL you enter and don't keep the results. Submitted IPs are checked in memory, never stored. Anonymous aggregate verdict counts feed our research posts; domains are counted once via an anonymized hash, never stored in the clear. Anonymous run-level outcome counters may be used for aggregate research; URLs, domains, IPs, and identifiers are never included, and no statistic is released below 100 runs.

Feedback
Report a bug

Found something broken in Bot Verifier? Let us know what happened — this goes straight to a private triage queue, not a public list.

What will be sent 
 No tool inputs, uploads, pasted source, complete results, query parameters, or URL fragments are attached automatically. You can edit or remove the selected passage above. Browser and anti-abuse metadata is processed for spam prevention. 
  
 
  
 
 
  
 
 
   
 
 
Bulk IPs or access-log lines
 
Paste up to 500 IPs or log lines. Published-range matching and user-agent claim extraction run entirely in your browser. Use Spot-check only for the few rows where you want live reverse-DNS confirmation.
  
    
 
 
 
 
Sample report Example data — real, DNS-verified result
 

You spot this line in your access log and want to know if it's really Google:

 
 
66.249.66.1 - - [08/Jul/2026:14:22:10 +0000] "GET /pricing HTTP/1.1" 200 "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
 
 

You paste 66.249.66.1 and choose Googlebot. The tool returns:

  
     
  • Both checks independently pass. The IP falls inside Google's published range
and its PTR record forward-confirms — see
what the five verdict tiers mean for why that combination is the
            strongest possible result.
    •  
  • Serve it normally. A green Verified badge means this really is
            Googlebot — no reason to block or challenge the request.
    •  
  • What a fake would look like instead. Had the IP matched no range and failed
            reverse DNS, the badge would read Spoofed and the evidence would name the network the IP
            actually belongs to, with copy-paste block rules underneath.
    •  
  • New to crawler identity checks? User agent covers why the
            string alone proves nothing, and AI crawlers explains who's
            crawling and why.
    •  
 
 
 
How to use it
 
     
  1. Grab the IP address of the request from your server logs — not the user-agent
            string, which any script can forge. Paste it into the IP field (IPv4 or IPv6).
    2.  
  2. In Claims to be, pick the crawler the user agent says it is (for example
            Googlebot). Spoof detection only runs when there's a claim to test; leave it on
Auto-detect to just see whether the IP belongs to any known crawler.
    3.  
  3. Press Verify. The tool checks the operator's published IP ranges and runs
            forward-confirmed reverse DNS, then returns a coloured verdict badge.
    4.  
  4. Open Evidence to see the matched range, the PTR hostname, whether the forward
            lookup confirmed, and — for fakes — the real network owner (ASN).
    5.  
  5. If the verdict is Spoofed, copy the ready-made Cloudflare, nginx, or Apache
            block rule from the panel that appears.
    6.  
 
 
      
     
Supported bots and verification methods
 

Not every operator makes verification possible. Some publish IP ranges and support reverse DNS, some publish ranges only,
        and some publish nothing at all — a user agent alone proves nothing, since any script can send any user-agent string.

 
 
 
BotOperatorTypePublished IP listReverse DNS
  
 Googlebot · docs Google Search ✅ 315 ranges ✅ .googlebot.com, .google.com 
 Google special crawlers · docs Google Search ✅ 270 ranges ✅ .google.com 
 Google user-triggered fetchers · docs Google User-triggered ✅ 1506 ranges ✅ .gae.googleusercontent.com, .google.com, .googleusercontent.com 
 Bingbot · docs Microsoft Search ✅ 28 ranges ✅ .search.msn.com 
 YandexBot · docs Yandex Search ❌ none ✅ .yandex.ru, .yandex.net, .yandex.com 
 Baiduspider · docs Baidu Search ❌ none ❌ 
 Yeti · docs Naver Search ❌ none ❌ 
 GPTBot · docs OpenAI AI training ✅ 21 ranges ❌ 
 OAI-SearchBot · docs OpenAI AI search ✅ 35 ranges ❌ 
 ChatGPT-User · docs OpenAI User-triggered ✅ 286 ranges ❌ 
 ClaudeBot · docs Anthropic AI training ✅ 0 ranges ❌ 
 PerplexityBot · docs Perplexity AI search ✅ 8 ranges ❌ 
 Perplexity-User · docs Perplexity User-triggered ✅ 4 ranges ❌ 
 Applebot · docs Apple Search ✅ 12 ranges ✅ .applebot.apple.com 
 Amazonbot · docs Amazon AI training ❌ none ✅ .crawl.amazonbot.amazon 
 DuckDuckBot · docs DuckDuckGo Search ✅ 481 ranges ❌ 
 Meta-ExternalAgent · docs Meta AI training ❌ none ❌ 
 Bytespider ByteDance AI training ❌ none ❌ 
  
 
 
How verification works
 
 
     
  1. Published-range check. The IP is matched against the operator's official IP range list (the same JSON files Google, Microsoft, OpenAI, Perplexity, Apple, and DuckDuckGo publish), refreshed weekly.
    2.  
  2. Forward-confirmed reverse DNS (FCrDNS). For bots that support it, the IP's PTR record must resolve to an official hostname (e.g. crawl-66-249-66-1.googlebot.com) at a domain-label boundary, and a forward lookup of that hostname must answer the exact same IP. Both directions must agree — a PTR record alone is trivially fakeable.
    3.  
  3. Naming the spoofer. When a claim fails both checks, the IP's actual network owner is looked up via its ASN, so the verdict says who it really is instead of just "not Googlebot."
    4.  
 
The three positive verdict tiers are deliberately distinct: reverse-DNS confirmed is proof; a published-list match is strong but not confirmation; and unverifiable bots (Bytespider, ClaudeBot, Meta) publish nothing — treat those user agents with suspicion.
 
 

Need evidence across many requests? Use the Log File Analyzer to inspect crawl budget by bot and section, status-code waste, and spoofing signals. Log parsing stays in your browser.

  
 
What the results mean
 
The badge colour maps to one of five verdicts:
 
     
  • Verified — reverse-DNS confirmed — the strongest
            result. Forward-confirmed reverse DNS resolves to an official crawler hostname. This is proof.
    •  
  • In published ranges — the IP falls inside the operator's
            published IP list. Strong, but not the same as reverse-DNS confirmation (used for crawlers that
            publish ranges but don't support rDNS).
    •  
  • Spoofed — the IP claims a crawler it isn't in any
            range for and fails reverse DNS. The evidence names who the IP really belongs to, and block rules
            appear below.
    •  
  • Unverifiable — the claimed operator publishes no
            IP ranges and supports no reverse DNS (e.g. Bytespider, ClaudeBot, Meta), so the claim can't be
            confirmed or denied. Treat with suspicion.
    •  
  • Not a known crawler — the IP doesn't match any known
            crawler's ranges and no claim resolved. It's ordinary traffic, or a bot you'd manage by behaviour.
    •  
 
How it works
 

Verification runs on a small server endpoint (/api/verify-bot) because it needs live
          DNS and a network-owner lookup your browser can't do. It never runs JavaScript against your site or
          stores the IP — the address is checked in memory and discarded.

 
     
  • Published-range match. The IP is tested against the operator's official CIDR
            ranges — the same JSON lists Google, Microsoft, OpenAI, Perplexity, Apple, and DuckDuckGo publish,
            baked into the tool and refreshed weekly.
    •  
  • Forward-confirmed reverse DNS. For crawlers that support it, the IP's PTR
            record must resolve to an official hostname at a domain-label boundary, and a forward lookup of
            that hostname must answer the exact same IP. Both directions must agree.
    •  
  • Naming the spoofer. When a claim fails both checks, the IP's ASN is resolved so
            the verdict can say who the network really is instead of just "not Googlebot."
    •  
 
Features
 
     
  • Two independent checks — published IP ranges and forward-confirmed reverse DNS — not a
            user-agent string match.
    •  
  • Five distinct verdicts, including an honest Unverifiable for operators that publish
            nothing.
    •  
  • Evidence drawer showing the matched range, PTR hostname, forward-confirmation result, ASN owner,
            and when the range lists were last fetched.
    •  
  • Copy-paste block rules (Cloudflare WAF, nginx, Apache) generated for any IP flagged spoofed.
    •  
  • A coverage table of every supported crawler — operator, type, whether it publishes ranges, and
            its reverse-DNS suffixes.
    •  
  • IPv4 and IPv6 supported; IPs are checked in memory and never stored; range lists refreshed weekly.
    •  
 
Limitations
 

Verification is only as good as what an operator publishes. Crawlers that publish neither IP ranges
          nor reverse DNS (Bytespider, ClaudeBot, Meta) can only ever come back Unverifiable. The
          tool checks one IP at a time — for a whole access log, wait for the crawler log analyzer or use the
Bulk HTTP Status Code Checker to triage first. It reflects
          the IP as it is right now; a spoofer that has since moved will read differently. And it verifies
          identity, not intent — a genuinely verified crawler can still be one you'd rather rate-limit.

 
Frequently asked questions
 
How do I verify Googlebot is real?
Take the IP address from your server logs (not the user-agent string, which anything can fake) and check it two ways: match it against Googlebot's published IP ranges, and run a forward-confirmed reverse DNS lookup — the IP's PTR record should resolve to a hostname ending in googlebot.com or google.com, and a forward lookup of that hostname must return the same IP. This tool does both automatically when you paste the IP and pick Googlebot.
What is forward-confirmed reverse DNS (FCrDNS)?
FCrDNS is a two-way DNS check. First a reverse lookup turns the IP into a hostname via its PTR record; then a forward lookup of that hostname must resolve back to the exact same IP. Both directions have to agree at an official domain boundary. A PTR record on its own proves nothing because the owner of an IP block can set it to any string, so the forward confirmation is what makes it trustworthy.
Why does a crawler show as "unverifiable" instead of verified or spoofed?
Some operators — Bytespider and Meta's crawler among them — do not publish IP ranges or support reverse DNS, so there is no authoritative range/DNS check for their claims. The tool returns "unverifiable" rather than guessing. Anthropic is no longer in that bucket: it publishes an official crawler IP list. A match is reported specifically as a published-list match, not as reverse-DNS confirmation, and a user-agent string alone remains spoofable.
Can I block a fake crawler by IP?
You can, and the tool gives you copy-paste block rules for Cloudflare, nginx, and Apache when a verdict comes back spoofed. But blocking a single IP is whack-a-mole — spoofers rotate addresses. For persistent fake-crawler traffic it is more effective to block by the ASN (network owner) the tool names in the evidence, or to use your firewall's bot-management rules.
Does checking an IP here store or log it?
No. Submitted IPs are checked in memory against the published range lists and live DNS, and are not written to any store. The range lists themselves are refreshed weekly from the operators' official sources, so a verdict reflects ranges that are at most a few days old.
 
 
 
     
Next stepXML Sitemap Generator — generate the corrected version.

People also explore
ToolLog File AnalyzerToolrobots.txt TesterToolAI-Crawler Access CheckerArticleUser AgentArticleAI Crawler Log AnalysisArticleCrawling
 
 
 
Feature requests for Bot Verifier
 

Upvote what you want most. New ideas can be submitted from the floating Feedback menu;
      requests appear here once approved, and the most-wanted rise to the top.

   
Loading…
  
  ➕ Request a feature   
New requests are reviewed before they appear here.
 
     
  
  
 
 
 
 
   
   
ツールについて
Googlebot、Bingbot、GPTBot、ClaudeBotなどを名乗るIPが本物かを確認します。公開IPレンジと正引き確認済みの逆引きDNSを使い、なりすましに対する実ネットワーク所有者を示します。IPはメモリ上だけで確認し保存しません。
機能
  • 公開IPレンジとの照合
  • 正引き確認済み逆引きDNS
  • 実ネットワーク所有者の表示
  • IPを保存しない検証
仕組み
入力IPとクローラー名を確認し、公開IPレンジ、逆引き、正引きの一致を検証します。観測したネットワーク所有者と未確認の主張を分けて表示します。
制限事項
  • 検証は公開レンジとDNS応答に基づき、リクエストが実際にそのクローラーから来たこと、将来のIP変更、プロキシや共有ネットワークを保証しません。
  • DNSや公開レンジは更新される可能性があり、瞬間的な結果です。
よくある質問
IPがGooglebotだと確定しますか？
公開レンジと正引き確認済み逆引きDNSが一致するかを示しますが、リクエストの完全な出所を保証しません。
IPは保存されますか？
いいえ。IPはメモリ上で検証し、保存しません。
すべてのクローラーを認識しますか？
登録された公開レンジを確認します。未知または更新前のクローラーは未確認になる場合があります。