Verify a crawler IP: is it really Googlebot or GPTBot?
An address is verified as a crawler when it lies inside the IP ranges the operator publishes or when its reverse DNS name ends in the operator's domain and resolves back to the same address. Enter an address from your server log; this tool runs that check, using only what the operator documents, and never connects to the address.
Try it with 66.249.66.1, an address in Google's published Googlebot ranges.
How the check works
- Published IP list. Where the operator publishes its crawler ranges as a machine-readable file, the address must be inside one of them. The lists are read over HTTPS from the operator's own host.
- Forward-confirmed reverse DNS. Where the operator documents it, the address must have a reverse name under the operator's domain, and a forward lookup of that name must return the same address.
- Only documented methods. 14 bots have one of these. For the others the operator publishes nothing we could use, and we say so instead of guessing; see each bot's page for its method and source.
What the answer does not tell you
- It is only as good as the address you enter. Behind a CDN or proxy, log the client address the proxy forwards, not the proxy's own.
- Verified means the address belongs to the operator, not that the request was well behaved or followed robots.txt.
- Operators change their ranges. A fresh list can differ from the copy we cached, and some operators, such as Anthropic, advise against blocking by IP address.
- Requests signed with Web Bot Auth can be genuine from any address; this tool does not check signatures. Last reviewed 2026-10-18.
Questions
How do I check whether a request is really from Googlebot?
Take the requesting IP address from your server log, enter it here and choose Googlebot. The tool compares the address with the IP ranges Google publishes and, as a second method, runs the reverse DNS lookup Google documents: the name must sit under a Google domain such as googlebot.com or google.com and must resolve back to the same address.
What does "not verified" mean?
The address is outside every published range, or its reverse DNS name does not confirm it. It is a strong sign that the request only borrowed the bot's name. It is not proof: an operator's list can lag behind its real addresses, so read the detail line before you block anything.
Why is a bot listed as undecided?
Either the operator's list or a DNS server did not answer in time, or the result of one method could not be read. Try again in a minute; a failed lookup is never reported as a pass or a fail.
Which bots can be verified?
Only bots whose operator documents a method: a machine-readable IP list or forward-confirmed reverse DNS. Many crawlers document neither, and for those the user agent alone cannot show that a request is genuine. Our study of forged bot names shows how common borrowed names are.
Does the tool store or contact the address I enter?
It never connects to the address. It reads the operator's public IP lists and asks DNS for the address's reverse name, then forgets the address. Only a rate-limit counter tied to a hash of your own IP address is kept, for a short time.
Have only a user-agent string? Use the user-agent lookup. Many checks at once, or in a script: npx crawlerpeek verify 66.249.66.1 --bot Googlebot runs the same check locally, see the CLI. The scripts for log files are in Fake Googlebots and PHP scanners.