The forgery problem
A User-Agent header is a string the client chooses. Scrapers routinely set theirs to 'GPTBot' because some sites whitelist it. If an analytics product counted every such request as an AI visit, its 'AI traffic' numbers would be a mix of real crawlers and whoever felt like impersonating one — and you'd have no way to tell which.
Two ways an operator can prove a crawler is theirs
Some operators publish the IP ranges their crawlers use as a machine-readable JSON feed. OpenAI does this per bot (GPTBot, OAI-SearchBot, ChatGPT-User), and Perplexity does it for PerplexityBot and Perplexity-User. Others rely on reverse DNS: Google's crawlers resolve to googlebot.com or google.com hostnames, Bing's to search.msn.com, Apple's to applebot.apple.com, Meta's to fbsv.net. We check rDNS and then forward-resolve the hostname back to the original IP, so a spoofed PTR record doesn't pass.
Three trust levels, not two
A hit ends up in one of three states. Verified: the IP matched a published range or passed the rDNS round-trip. Spoofed: the operator publishes verification data and this IP failed it. Unverified: the operator publishes neither ranges nor documented rDNS, so there's nothing to check against. That last one matters — as of mid-2026, Anthropic doesn't publish a range feed or documented crawler rDNS, so ClaudeBot hits are unverified, not spoofed. Reporting them as fake would be wrong.
Why a dead feed can't create false accusations
Range-feed URLs drift. If a feed fails to load, every hit that depended on it degrades to unverified, never to spoofed. The failure mode is 'less information,' not 'a real crawler flagged as an impostor.' Trust is also decided server-side at ingest: whoever posts log lines to us can't assert a hit is verified, only supply the raw evidence.
What this buys you
When the dashboard says GPTBot fetched your pricing page fourteen times last week, that number means fourteen requests from IPs OpenAI says are GPTBot. The unverified column is shown separately, so you can decide how much weight to give it — instead of one blended number that's quietly part guesswork.
See this on your own brand
Run the free check — same scoring the dashboard uses, no account needed.
Run free check