How to spot fake Googlebot traffic
A user agent is a claim, not an identity. Anything can call itself Googlebot, plenty of things do, and the check that unmasks an impostor is public and takes seconds.
Last updated
Why bots wear the Googlebot costume
Nearly every site whitelists Googlebot, because blocking it risks rankings. That makes the name the cheapest disguise on the internet: a scraper that claims it walks past robots.txt rules, firewall filters, and rate limits that would stop it under its own name.
The check is public
Google publishes the verification procedure itself: run a reverse DNS lookup on the visiting address, confirm the name ends in googlebot.com or google.com, then resolve that name forward and confirm it returns the same address. An impostor cannot pass it, because it cannot control Google DNS records.
TrueVisit runs the same check on every visit claiming to be Googlebot or Bingbot, and the four layer detection stores the outcome in the verdict, so the row for an impostor reads "claims Googlebot, fails verification" rather than a bare score.
A confirmed fake is a deliberate act
Most bot traffic is merely undeclared. A failed Googlebot verification is different: nobody impersonates a search engine by accident, so this is one of the few verdicts that carries intent. Traffic from a source that includes confirmed impostors deserves more suspicion than its bot percentage alone suggests.
Block the fakes without touching the real one
The rule builder in our Cloudflare guide includes an impersonator rule for exactly this case: it blocks anything claiming to be a search engine that Cloudflare has not verified as one, so the real Googlebot walks through untouched while every impostor hits a wall.