{
  "slug": "verified-vs-spoofed-googlebot",
  "name": "Verified versus spoofed Googlebot",
  "aliases": [
    "Bot verification",
    "Googlebot IP verification"
  ],
  "definition": "How many requests claiming to be Googlebot came from an address Google publishes, and how many did not.",
  "category": "Crawl and logs",
  "type": "raw measure",
  "unit": "log requests, split by verified and unverified",
  "direction": "neutral",
  "verification": "verified",
  "calculation": "Log records whose declared bot type is Googlebot are joined to an address lookup that flags whether the requesting address is a Google one, and counted on each side of that flag. The join is an INNER one on the requesting address, so a request whose address is absent from the lookup table is dropped from the result entirely rather than landing on the unverified side.",
  "aggregation": "Counts per verification state. The two sides do NOT add to the total of declared-Googlebot requests, anything whose address the lookup does not know is excluded by the join, so the split describes only the addresses the lookup recognises.",
  "grain": "One count per verification state per date range.",
  "dimensions": [
    "bot_type",
    "is_googlebot_ip"
  ],
  "requiredFilters": [
    "date_range"
  ],
  "sources": [
    "server-logs"
  ],
  "reports": [
    "ai-bot-activity-report",
    "crawl-log-report",
    "technical-seo-audit-report"
  ],
  "skills": [
    "ai-crawler-readiness",
    "technical-health-audit",
    "crawl-efficiency-review"
  ],
  "verbs": [
    "bot_verification"
  ],
  "rungs": [
    "R1"
  ],
  "levers": [
    "L1"
  ],
  "questions": [
    "Are fake Googlebots hitting us?",
    "Can we trust our crawler traffic?"
  ],
  "interpretation": "The only claim in this set that separates what a client said it was from what it demonstrably is. The split itself is the finding, a large unverified share means the crawl numbers describing that bot are worth less than they look. Read it as a floor on spoofing rather than a measurement of it: the join keeps only requests from addresses the lookup already knows, so an impostor arriving from an address nobody has catalogued never reaches either column.",
  "caveats": [
    "The two sides do not reconcile to the declared-Googlebot total. The address lookup is joined INNER, so unknown addresses are dropped rather than counted as unverified, never compute one side by subtracting the other from a hit count.",
    "For the same reason the unverified figure UNDERSTATES spoofing, and by an unknown amount: the requests most likely to be missing from an address catalogue are exactly the ones least likely to be Google.",
    "Googlebot only. The tool filters to the declared Googlebot type and joins a Google-specific address lookup; there is no equivalent verification for any answer-engine crawler.",
    "That means AI-bot figures elsewhere in this set rest on user-agent strings alone, with no address check behind them.",
    "Verification is a per-request property, so a single source can appear on both sides of the split within a period.",
    "Same origin-only caveat as all log reads."
  ],
  "freshness": "hours to nightly, depends on how logs are shipped; the card carries the ingestion time.",
  "failureModes": [
    "Treating the two counts as a partition of declared-Googlebot traffic, or deriving one from the other.",
    "Quoting the unverified count as the amount of spoofing rather than as a lower bound on it.",
    "Assuming AI crawler counts are verified the same way, they are not.",
    "Including unverified traffic in a crawl-coverage verdict."
  ],
  "notSameAs": [
    {
      "slug": "bot-hits",
      "why": "Hit counts are matched on the declared user agent alone. Only this metric establishes whether the requester was who it claimed to be, and only for Googlebot."
    }
  ],
  "related": [
    "bot-hits",
    "status-code-hits"
  ],
  "workflows": [],
  "lastVerified": "2026-08-04"
}