# Fake Googlebot: how to verify Googlebot IP addresses

> A fake Googlebot is a scraper or scanner that sends Googlebot's user agent. How to verify a real Googlebot IP address with reverse DNS or Google's published IP ranges, and what to do with the fakes.

Updated 2026-09-26 · Technical SEO · HTML version: https://getreport.app/guides/verify-googlebot-fake-googlebot

A fake Googlebot is any client that sends Googlebot's user agent without being Google: usually a scraper, a vulnerability scanner or a spam bot hoping your firewall waves Googlebot through. The user agent proves nothing, because anyone can type it. The IP address does: a real Googlebot IP address reverse-resolves to a Google host name that resolves back to the same address, and it sits inside the IP ranges Google publishes. This guide shows both checks, by hand and in bulk, and how to block impostors without ever touching the real crawler. For how Googlebot works in general, start with the [guide to Googlebot and crawling](https://getreport.app/guides/googlebot-and-crawling).

## Quick answer

- **Never trust the user agent.** Verify the IP address.
- **Reverse DNS, then forward DNS.** The address must resolve to a name ending in `googlebot.com`, `google.com` or `googleusercontent.com`, and that name must resolve back to the same address.
- **Or match Google's published ranges.** `common-crawlers.json` lists Googlebot's addresses; separate files cover special-case crawlers and user-triggered fetchers. They moved to `developers.google.com/static/crawling/ipranges/` in 2026.
- **Check a whole log at once** with the [log file analyser](https://getreport.app/tools/log-analyser): one click verifies every address that claimed to be Googlebot or Bingbot.
- **Block fakes at the firewall or CDN**, never with a `User-agent: Googlebot` rule in robots.txt, which only the real Googlebot obeys.

## Why fake Googlebots exist

Many sites treat Googlebot as a VIP: no rate limit, no CAPTCHA, no bot challenge, sometimes content that visitors must log in to see. Scrapers noticed. Copying Googlebot's user agent is the cheapest way to get the same treatment, and it costs one line of code.

In an access log, fakes often give themselves away by what they request. A client calling itself Googlebot that probes `/wp-login.php`, `/.env` or `/xmlrpc.php` hundreds of times a day is not indexing your content. But behaviour is only a hint; the address is proof.

## How Google says to verify Googlebot

Google documents two methods in its crawler verification guide on Google Search Central, now part of its crawling infrastructure documentation. Either is enough.

### Method 1: reverse DNS, then forward DNS

1. Run a reverse DNS lookup on the IP address from your log.
2. Check that the host name ends in `googlebot.com`, `google.com` or `googleusercontent.com`.
3. Run a forward DNS lookup on that host name.
4. Check that it returns the original IP address.

On Linux or macOS:

```bash
host 66.249.66.1
# 1.66.249.66.in-addr.arpa domain name pointer crawl-66-249-66-1.googlebot.com.

host crawl-66-249-66-1.googlebot.com
# crawl-66-249-66-1.googlebot.com has address 66.249.66.1
```

On Windows, `nslookup 66.249.66.1` and then `nslookup crawl-66-249-66-1.googlebot.com` do the same.

Step 3 is the one people skip, and it is the one that matters. Whoever controls an IP block controls its reverse DNS, so a scraper can make its own address resolve to `crawl-1-2-3-4.googlebot.com`. It cannot make Google's DNS point that name back at its address. Only when both directions agree is the visit real.

### Method 2: Google's published IP ranges

Google publishes the address ranges of its crawlers as JSON files, one per kind of crawler. This is the better method for a firewall allow-list or for checking thousands of addresses, because it needs no DNS lookups.

| Kind of crawler | Examples | Reverse DNS looks like | IP range file |
| --- | --- | --- | --- |
| Common crawlers | Googlebot, Googlebot-Image, Googlebot-Video, Storebot-Google, GoogleOther | `crawl-66-249-66-1.googlebot.com` or `geo-crawl-….geo.googlebot.com` | `common-crawlers.json` |
| Special-case crawlers | AdsBot-Google, Mediapartners-Google | `rate-limited-proxy-….google.com` | `special-crawlers.json` |
| User-triggered fetchers | Google Site Verifier, Feedfetcher, Google-Read-Aloud | `….gae.googleusercontent.com` or `google-proxy-….google.com` | `user-triggered-fetchers.json`, `user-triggered-fetchers-google.json` |
| User-triggered agents | Google-Agent | — | `user-triggered-agents.json` |

All files live under `https://developers.google.com/static/crawling/ipranges/`. Google moved them there from `/search/apis/ipranges/` in 2026 and renamed `googlebot.json` to `common-crawlers.json`; the old addresses stopped returning the ranges soon after. If a firewall script or plugin still fetches `googlebot.json` from the old path, it is working from an empty or stale list, so update it.

Each file has a `creationTime` and a list of `prefixes`, each an `ipv4Prefix` or `ipv6Prefix` in CIDR notation. A short script to check addresses against the Googlebot file:

```python
# check_googlebot.py — python3 check_googlebot.py 66.249.66.1 203.0.113.9
import ipaddress, json, sys, urllib.request

URL = "https://developers.google.com/static/crawling/ipranges/common-crawlers.json"
data = json.load(urllib.request.urlopen(URL))
nets = [ipaddress.ip_network(p.get("ipv4Prefix") or p["ipv6Prefix"]) for p in data["prefixes"]]

for ip in sys.argv[1:]:
    addr = ipaddress.ip_address(ip)
    real = any(addr in net for net in nets if net.version == addr.version)
    print(ip, "Google common crawler" if real else "not in the list")
```

The ranges change. Fetch the file on a schedule, daily is plenty, rather than copying today's prefixes into a config file.

## How to check every "Googlebot" in your log

Checking addresses one by one works for a suspicious handful. For a month of logs, let a tool do it:

> **Free tool:** [Log file analysis for SEO: free log analyzer](https://getreport.app/tools/log-analyser): Free log file analysis for SEO in your browser: see what Googlebot and AI crawlers fetch, the 404s they hit and which bots are fake. Nothing is uploaded.

Drop your access log into the log file analyser. It reads the file in your browser, groups the hits by bot, and shows the addresses that claimed to be Googlebot. Click **Verify Googlebot & Bingbot addresses** and only those IP addresses, at most 200 per bot ranked by hits, go to getReport's server. It runs the reverse-then-forward DNS check described above and marks each address:

- **Verified**: the name is under `googlebot.com` or `google.com` (or `search.msn.com` for Bingbot) and resolves back to the same address.
- **Fake**: the name points somewhere else, or it does not resolve back.
- **Unknown**: the address has no reverse DNS record at all. That is common on cloud networks and is not proof either way.

Nothing else from the file leaves your device. If you have not pulled a log before, [reading Apache and nginx access logs](https://getreport.app/guides/reading-access-logs-apache-nginx) shows where it lives and what each field means.

To pull the addresses out yourself first:

```bash
# Addresses that claimed to be Googlebot, most active first
grep 'Googlebot' access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20
```

## What to do with fake Googlebots

### Block at the firewall or CDN

Fakes ignore robots.txt, so the block has to be enforced by the server or the network in front of it. On Cloudflare, a WAF custom rule can block any request that claims to be Googlebot but is not on Cloudflare's verified bot list:

```text
(http.user_agent contains "Googlebot" and not cf.client.bot)  →  Block
```

On your own server, block the specific fake addresses or networks you found, or rate-limit clients that send a Googlebot user agent from addresses outside Google's ranges. The guide to [rate limiting and bot protection on a small site](https://getreport.app/guides/rate-limiting-and-bot-protection-on-a-small-site) shows how to slow abusive bots without catching Google.

### Never block by user agent alone

A rule that blocks or throttles every request containing "Googlebot" hits the real crawler too, and a robots.txt group for `User-agent: Googlebot` is read only by the real Googlebot. Both take you out of Google while the scraper carries on. The report flags robots.txt rules that block the page you checked:

> **Check: robots.txt allows this page.** A Disallow rule stops search engines from crawling this page, so they cannot read its content or see any updates. The page can still appear in results as a bare URL with no description.
>
> 1. Remove or narrow the Disallow rule in robots.txt so this URL is allowed for all crawlers.
> 2. If the page should stay out of search, allow crawling and use a noindex tag instead; a blocked page cannot be de-indexed.

### Allow-list the real one first

If you run strict bot rules, add Google's published ranges as an explicit allow before any user-agent or rate-limit rule, and keep the list updated automatically.

## Bingbot and other search crawlers

Bing documents the same reverse-then-forward test: real Bingbot addresses resolve to host names ending in `search.msn.com`. Microsoft also publishes Bingbot's ranges at `https://www.bing.com/toolbox/bingbot.json` and offers a Verify Bingbot tool in Bing Webmaster Tools. Applebot resolves under `applebot.apple.com`. AI crawlers vary: OpenAI and Perplexity publish JSON range files for their bots, and the guide to [detecting AI crawlers in server logs](https://getreport.app/guides/detect-ai-crawlers-in-server-logs) lists them.

## Common mistakes

- **Trusting reverse DNS without the forward check.** Anyone who controls an IP block can set its reverse record to a Google-looking name.
- **Hard-coding `66.249.x.x`.** Many Googlebot fetches come from there, but not all, and ranges change. Use the published file.
- **Reading "unknown" as "fake".** No reverse record means you cannot tell by DNS; match the address against the published ranges instead.
- **Verifying the proxy's address.** Behind Cloudflare or a load balancer, your log may show the proxy's IP for every request. Log the real client address first, or every Googlebot will fail verification.
- **Forgetting IPv6.** Google crawls over IPv6 too, and the files list IPv6 prefixes. Make sure your script and firewall handle both.

## Questions people ask

### How do I verify that Googlebot is real?

Take the IP address from your log, run a reverse DNS lookup and check that the name ends in googlebot.com, google.com or googleusercontent.com. Then look up that name and confirm it returns the same address. Alternatively, check the address against Google's published common-crawlers.json. The user agent string alone never proves anything, because any client can send it.

### Where does Google publish Googlebot's IP ranges?

In JSON files under developers.google.com/static/crawling/ipranges/. Googlebot and the other common crawlers are in common-crawlers.json, formerly called googlebot.json; special-case crawlers, user-triggered fetchers and user-triggered agents have their own files. Google moved the files to this path in 2026, so update any script or plugin that still fetches the old /search/apis/ipranges/ address.

### Is every visit from a 66.249 address Googlebot?

Most Googlebot fetches do come from addresses starting with 66.249, but you should not rely on that. Google's ranges are wider, include IPv6, and change over time, and the published JSON file is the only authoritative list. Check the exact address against the file, or run the reverse and forward DNS test, before allowing or blocking it.

### Should I block fake Googlebots?

Yes, if they cost you bandwidth or probe for vulnerabilities, but block them by IP address at the firewall or CDN, never by user agent or in robots.txt. Those two methods also hit the real Googlebot, which takes your site out of Google while the fake ignores the rule. Verify the addresses first, then block the fakes.

### Why does a fake Googlebot show as unknown instead of fake?

Because the address has no reverse DNS record, so the DNS test cannot say who owns it. That is common on cloud and hosting networks. It is not proof of anything, but a real Googlebot always has a reverse record under Google's domains, so an address claiming to be Googlebot without one is almost certainly not Google. Check it against the published ranges to be sure.