Bot verification tools
A User-Agent is a claim, not an identity. Anyone can send Googlebot/2.1, and a great many things do, because most sites let Googlebot past rules they apply to everyone else.
These tools check a claim against the address lists the operators themselves publish. No account, no signup, and nothing logged against you.
Verify a crawler
Is this really Googlebot?
Operated by Google. Checked against their published address list.
Is this really GPTBot?
Operated by OpenAI. Checked against their published address list.
Is this really ClaudeBot?
Operated by Anthropic. Checked against their published address list.
Is this really Bingbot?
Operated by Microsoft. Checked against their published address list.
Is this really PerplexityBot?
Operated by Perplexity AI. Checked against their published address list.
Crawler IP ranges
The address lists themselves, for every operator that publishes one.
JA4 fingerprint lookup & decoder
Validate and decode a TLS fingerprint field by field, then check its hashes against a known corpus.
Why a User-Agent proves nothing
The User-Agent header is a string the client chooses. Nothing stops a scraper sending Googlebot's, and claiming it is the cheapest way to inherit the access you granted Google: past the rate limit, past the bot rules, past the checks you apply to everyone whose ranking you do not depend on.
What cannot be copied is the infrastructure. Google, OpenAI, Anthropic, Microsoft, Apple and Perplexity all publish the addresses their crawlers use, precisely so the claim can be settled. These tools compare against those lists, and where an operator documents reverse DNS instead, they do the forward-confirmed lookup that operator specifies.