New Free Bot Verification Tools from WebDecoy

A request reaches your server with Googlebot/2.1 in its User-Agent. Another says it is GPTBot. A third claims to be PerplexityBot and immediately starts crawling pages you normally keep behind strict rate limits.

Are those requests genuine?

The crawler name does not answer the question. A User-Agent is text chosen by the client, and copying a trusted crawler’s name takes one line of code. What matters is whether the infrastructure behind the request matches the infrastructure the operator publishes.

That is why we built the new WebDecoy bot verification tools. They let anyone check individual crawler claims, inspect the official address ranges behind major search and AI crawlers, and decode JA4 TLS fingerprints without creating an account.

What Is Available in the Tools Hub

The tools hub brings seven resources together in one place:

1. Googlebot verifier
2. GPTBot verifier
3. ClaudeBot verifier
4. Bingbot verifier
5. PerplexityBot verifier
6. Crawler IP range reference
7. JA4 fingerprint decoder

The crawler checkers answer a specific question about one request. The range reference exposes the source data used to answer it. The JA4 decoder helps explain the TLS fingerprint associated with a client connection.

Together, they turn a vague log entry into evidence you can evaluate.

Why Crawler Names Need Verification

Most websites treat recognized crawlers differently from ordinary automation. Googlebot may bypass a bot rule because blocking it could affect search visibility. Bingbot needs access to keep pages available in Bing and Copilot. AI search crawlers may be allowed so content can appear in generated answers.

That access makes trusted crawler names valuable to attackers.

A scraper that calls itself Googlebot may inherit the exceptions intended for Google. A client claiming to be an AI search crawler may get past a rule designed to block unapproved training crawlers. A forged identity can also make logs misleading, which complicates incident response and traffic analysis.

The User-Agent cannot settle identity because it is self-declared. Published network ranges, forward-confirmed reverse DNS, and cryptographic signatures provide stronger evidence.

The new tools focus on the evidence available today: the authoritative IP lists and verification procedures published by crawler operators.

Verify Googlebot

The Googlebot verification tool checks an address against Google’s published Googlebot infrastructure. Google also documents a reverse DNS procedure that confirms a hostname belongs to its crawler domains and resolves back to the original address.

Paste an IP address from your access logs and, optionally, the User-Agent it supplied. The result explains whether the request is verified, forged, or cannot be determined from the available data.

This is especially useful when a request claiming to be Googlebot:

• Crawls unusually fast
• Requests login, checkout, or administrative paths
• Ignores rules normally followed by search crawlers
• Appears from an unrelated hosting provider
• Triggers a security rule that Googlebot usually bypasses

A valid result confirms infrastructure, not intent. Googlebot still needs a route-appropriate policy, but you can stop debating whether the caller is actually Google.

Verify GPTBot

OpenAI operates several crawlers with different purposes. GPTBot collects content that may be used for model training. OAI-SearchBot supports the index behind ChatGPT search. ChatGPT-User fetches pages in response to a user’s request.

The GPTBot verification tool checks whether a source address belongs to OpenAI’s published GPTBot ranges. That distinction matters because many sites make different policy decisions for training, search inclusion, and user-requested retrieval.

Blocking GPTBot does not necessarily mean removing a site from ChatGPT search, just as allowing OAI-SearchBot does not grant every client using an OpenAI crawler name the same access. Identity comes first, then policy.

Verify ClaudeBot

Anthropic publishes an address list covering its crawlers. The ClaudeBot verification tool compares an address from your logs with that authoritative list.

It also helps clarify the difference between ClaudeBot, which performs broader crawling, and Claude-User, which retrieves a page because someone asked Claude about it. The requests may come from the same operator, but the purpose and site policy can differ.

If something claims to be ClaudeBot from infrastructure outside Anthropic’s published ranges, the name alone should not earn trust.

Verify Bingbot

The Bingbot verification tool supports Microsoft’s published address ranges and its documented reverse DNS process.

Bingbot matters beyond traditional search. Microsoft also uses it for experiences connected to Copilot, so blocking it can affect more than Bing indexing. That makes accurate verification preferable to a broad allow or block rule based only on the header.

Use the checker when Bingbot traffic behaves unexpectedly, arrives from unfamiliar networks, or receives exceptions from your normal automation policy.

Verify PerplexityBot

Sites often allow PerplexityBot because they want their content available in AI search answers. That creates the same incentive that has made Googlebot impersonation effective: a trusted name can buy access.

The PerplexityBot verification tool checks the source against the address ranges Perplexity publishes. A PerplexityBot User-Agent from outside those ranges is not verified merely because the string looks correct.

Understand the Three Possible Results

The tools do not force every lookup into a yes-or-no answer. They return one of three outcomes.

Verified

The address falls inside the operator’s published crawler ranges, or the operator’s documented reverse DNS procedure confirms it. This is positive evidence that the request came from the named operator.

Forged

The request claimed a crawler identity, but its source address is outside the complete range list published for that crawler. Something used the name without the operator’s infrastructure behind it.

Cannot tell

The available evidence cannot support a reliable verdict. This can happen when source data is unavailable or a documented verification path cannot be completed.

That third answer is important. A security tool should not turn missing data into certainty. If our copy of an operator list is stale or unavailable, the checker says so instead of classifying an address on incomplete evidence.

Browse the Published Crawler IP Ranges

Sometimes you need more than a single lookup. You may be building a firewall rule, auditing an allowlist, investigating a block of traffic, or comparing the data in your own pipeline.

The crawler IP range reference collects the ranges published by:

• Google
• Microsoft
• OpenAI
• Anthropic
• Perplexity
• Apple
• DuckDuckGo

The page fetches the source files during the site build and displays the available IPv4 and IPv6 prefixes with direct links back to each operator’s file. It also shows when a source could not be fetched instead of silently omitting the operator.

That transparency is intentional. If a range is absent because its source was unavailable, the absence is not evidence that traffic is forged.

The reference includes Googlebot, Bingbot, GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Applebot, and DuckDuckBot.

Decode JA4 TLS Fingerprints

IP verification answers whether an address belongs to a declared crawler operator. It does not describe the software stack behind every other automated client, especially bots using cloud hosts, residential proxies, or browser automation.

That is where TLS fingerprinting helps.

The JA4 fingerprint decoder breaks a JA4 value into its component fields, including protocol, TLS version, SNI behavior, cipher count, extension count, ALPN, and hashed sections. Decoding the value makes it easier to understand what a detection record or Cloudflare field is describing.

JA4 should not be used as a universal identity on its own. Multiple clients can share a fingerprint, and capable attackers can change parts of their TLS behavior. It is most useful when correlated with:

• User-Agent consistency
• Network and ASN information
• Request behavior
• Session continuity
• Headless browser evidence
• Decoy interaction
• Path and velocity patterns

For a deeper treatment, read JA4 Fingerprinting: Detect AI Scrapers by TLS.

How to Use the Tools During an Investigation

Imagine an access log containing this request:

198.51.100.24 - "GET /pricing/ HTTP/2" 200
User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

Start with the declared identity:

1. Open the Googlebot verifier.
2. Paste the source IP and User-Agent.
3. Review the verdict and supporting evidence.
4. If the identity is forged, search for other requests connected to the address, fingerprint, session, or behavior.
5. If the identity is verified, evaluate whether the requested route and crawl rate fit your Googlebot policy.

If the request has a JA4 value, decode it and compare it with other sessions. A forged crawler claim combined with a repeated automation fingerprint and suspicious navigation is much stronger evidence than any one signal alone.

From One Lookup to Continuous Verification

The free tools are designed for a log line, support ticket, firewall review, or investigation. They let you inspect the evidence without creating an account, and the crawler checker does not store who submitted the address.

A production site has a different problem. It may receive thousands of crawler claims, and forged actors rarely use one address forever. Checking each entry by hand does not scale.

WebDecoy applies the same verification model continuously. It evaluates requests that claim crawler identities, preserves failed claims as detections, and connects activity to an actor even when the source address changes. Network verification then becomes one layer alongside behavioral analysis, TLS fingerprints, browser signals, and deception.

You can explore that workflow on the Agent Identity product page or inspect the public bot telemetry directory to see how often declared crawler traffic verifies in practice.

Try the Tools

The complete collection is available now at webdecoy.com/tools.

Use the individual crawler checkers when a log entry makes a trusted claim. Use the range reference when you need the source data. Use the JA4 decoder when you need to understand a TLS fingerprint.

The principle behind all of them is simple: names are cheap, but evidence is not.