40% of "Googlebot" Traffic Is Fake: What We Found in 1.3M Requests

Of 1.33 million requests that called themselves Googlebot across a sample of ~400 websites between July and October 2026, 538,636 did not come from Google. That's 40.5%.

Most SEOs treat a Googlebot user agent as proof of a Google visit. It isn't. A user-agent string is one line of text that anyone can type, and a lot of scrapers, SEO tools and vulnerability scanners type "Googlebot" because sites wave it through.

TL;DR

• 40.5% of "Googlebot" requests were fake. For comparison, only 2.8% of Bingbot requests failed verification.
• Nearly every site gets them. 313 of 314 sites with meaningful Googlebot traffic received at least one fake. On the typical site, about 1 in 4 "Googlebot" hits is an impostor (median 27%).
• A few sites get hammered. The 10 most-targeted sites absorbed 80% of all fake Googlebot requests. On 53 sites, fakes outnumbered the real Googlebot.
• Fakes behave differently. They request each URL about twice as often as the real Googlebot (10.6 vs 5.5 times). They also probe admin and config paths 5× more often.
• Verifying takes two DNS lookups. If you make decisions from "Googlebot" in your logs, you're making some of them on scraper traffic.

The data

The numbers come from a sample of about 400 websites running behind HadoSEO's edge proxy. On each of those sites, the proxy logs every request from a known crawler, not a sample of them. There's no JavaScript tag, so bots that never run JS are still counted.

• Window: July 1 – October 26, 2026
• Sites: 395 domains that received at least one "Googlebot" request
• Requests: 1,329,987 with a Googlebot user agent
• Site types: a mix of SaaS marketing sites, ecommerce stores, agency client sites and apps built on Lovable, Base44 and similar tools

How we decide what's real. Every request with a Googlebot user agent has its source IP checked against the ranges Google publishes for its common crawlers. Google's documentation offers an equivalent reverse-DNS check, where the hostname must end in googlebot.com or google.com.

• Verified: the IP is in Google's range.
• Unverified: the user agent says Googlebot, but the IP isn't Google's.

In this article, "fake" means unverified. Every other major crawler goes through the same process, so the comparison is like for like.

What we found

Googlebot is impersonated far more than any other crawler

Googlebot isn't just faked more than Bingbot. It's faked more than every crawler we track, including AI crawlers like GPTBot and ClaudeBot, which sit at around 11%. Impersonators copy the bot that gets the most access, and on most sites that's Googlebot. Many firewalls, paywalls and rate limiters let it through automatically.

It's not a one-off spike

The fake share stayed at 44–45% every month from July through September. It dropped to 31% in October, partly because verified Googlebot crawling rose to 266K requests that month.

Almost every site gets fakes, and a few get flooded

• 313 of 314 sites (with 100+ Googlebot requests) saw at least one fake.
• On the median site, 27% of "Googlebot" traffic was fake. The middle half of sites ranged from 16% to 43%.
• On 53 sites, fakes outnumbered the real Googlebot.
• The 10 most-targeted sites absorbed 80% of all fake Googlebot requests.

So the 40% headline comes partly from a few heavily scraped sites. For an ordinary site, expect roughly 1 in 4.

Fake Googlebots crawl like scrapers, not like Google

The real Googlebot spreads across your site and checks the homepage often. Fakes skip the homepage, focus on a smaller set of deep pages and request them over and over. That's the pattern of content scrapers and price monitors. A small but real share probe for admin panels and leaked config files, using the Googlebot name to get past filters.

Why it matters

Your crawl analysis is wrong. Log-file analysis assumes every "Googlebot" line is Google. If a quarter of those lines are scrapers, your crawl budget numbers, crawl frequency per page and "pages Google never visits" lists are all off. You may conclude Google loves a section of your site when a scraper is actually hammering it.

You're paying for it. Fake crawlers request each URL about twice as often as Google does. On sites that render pages for bots (prerendering, SSR, edge functions), every fake request is compute you pay for and an origin hit your real visitors compete with.

"Allow Googlebot" is a hole in your defences. Rules that let Googlebot past a WAF, rate limiter, paywall or geo-block based on user agent alone also let in anyone who types that string. That's why 1% of fake traffic goes straight for admin and config paths.

You can't safely serve different content to Google. If you serve bots a prerendered or lighter version of a page, deciding by user agent alone hands that version to scrapers too. Worse, if you ever block or throttle "Googlebot" to stop a scraper, you risk hitting the real one.

How to verify Googlebot yourself

Google documents two verification methods: a DNS check for one-off looks and an IP-range check for automation. A quick log check tells you whether you have a problem at all.

Method 1: reverse and forward DNS (one-off checks)

1. Run a reverse DNS lookup on the IP from your logs.
2. Check that the hostname ends in googlebot.com or google.com.
3. Run a forward DNS lookup on that hostname and confirm it resolves back to the same IP.

$ host 66.249.66.1
1.66.249.66.in-addr.arpa domain name pointer crawl-66-249-66-1.googlebot.com.

$ host crawl-66-249-66-1.googlebot.com
crawl-66-249-66-1.googlebot.com has address 66.249.66.1

Both lookups have to match. A scraper can set its own reverse DNS to say googlebot.com, but it can't make Google's forward DNS point back to its IP.

Prefer not to use the terminal? Paste an IP into our free bot verifier.

Method 2: match against Google's published IP ranges (automation)

Google publishes the IP ranges for its crawlers as JSON. Download the file daily and check each request against it.

import ipaddress, json, urllib.request

URL = "https://developers.google.com/static/crawling/ipranges/common-crawlers.json"
data = json.load(urllib.request.urlopen(URL))
nets = [ipaddress.ip_network(p.get("ipv4Prefix") or p.get("ipv6Prefix"))
        for p in data["prefixes"]]

def is_real_googlebot(ip: str) -> bool:
    addr = ipaddress.ip_address(ip)
    return any(addr in n for n in nets)

print(is_real_googlebot("66.249.66.1"))   # True
print(is_real_googlebot("45.90.12.7"))    # False

Method 3: check your own logs in 30 seconds

Pull the unique IPs that claimed to be Googlebot, then run them through the function above.

grep -i "googlebot" access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -50

If the top IPs aren't in Google's ranges, your log analysis is already counting scrapers. You can also drop the file into our free log file analyzer.

What to do about fake Googlebot traffic

1. Stop trusting the user agent anywhere it grants access. Search your WAF, CDN, rate-limit and paywall rules for "Googlebot" and replace user-agent matches with IP or rDNS verification. On Cloudflare, use the verified-bot signal instead of a user-agent string.
2. Filter your log analysis. Before you look at crawl frequency, crawl budget or orphan pages, drop every "Googlebot" request that fails verification. Expect your Googlebot numbers to shrink by a quarter or more.
3. Block or rate-limit unverified "Googlebot" traffic, but only with fresh data. Blocking is safe only if your verification is up to date. Refresh Google's IP list at least daily so a new Google range never gets caught.
4. Serve fakes the cheap version. If you prerender for bots, give unverified crawlers a cached copy instead of a fresh render. They don't get special treatment, and you don't pay to render for scrapers.
5. Watch the targeting. If one section gets most of the fake traffic, someone is probably scraping it (pricing, listings, original content). That's useful competitive intelligence in itself.

FAQ

Is fake Googlebot traffic bad for SEO? Not directly. Google doesn't know about it and doesn't penalise you for it. The harm is indirect: wrong crawl data, wasted server and render costs, scraped content and security probes getting past filters built for Google.

Can I block fake Googlebots without hurting my rankings? Yes, if you verify by IP or reverse DNS. Real Googlebot always passes those checks. Blocking by user agent is what hurts rankings, because it hits real Google too.

Who sends fake Googlebot traffic? Mostly content scrapers, price and inventory monitors, and SEO or audit tools that spoof Googlebot to see what Google sees. A smaller share are vulnerability scanners probing for admin panels and exposed config files.

Do AI crawlers get spoofed too? Yes, less often. Between 9% and 16% of requests claiming to be GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot or Amazonbot failed verification. Some AI "user" fetchers (the ones that load a page when someone asks a chatbot a question) don't publish IP ranges at all, so they can't be verified either way.

Does Bing have the same problem? Much less. Only 2.8% of Bingbot requests failed verification, the lowest of any major crawler we track.

Methodology notes

• Verification checks the request IP against each operator's published IP ranges, or reverse DNS where the operator documents that instead. Lists are refreshed weekly.
• "Fake" means the user agent claimed Googlebot and the IP was outside Google's published common-crawler ranges. A small number could be Google traffic from ranges outside that list. That's unlikely to change the picture, since the gap with Bingbot is 14×.
• The sample is drawn from sites using HadoSEO, so it skews toward SaaS, ecommerce and AI-built sites. October 2026 covers the 1st to the 26th.
• Per-site figures include only the 314 sites with at least 100 Googlebot requests in the period.

See it on your own site

HadoSEO checks every crawler request at the edge, verified or not, and shows you per page who crawled it and what they were served. If you want to know what share of your "Googlebot" is real, run a free crawl scan or connect your domain in a few minutes.

Sources

• Google: Verifying Googlebot and other Google crawlers
• Google: common crawlers IP ranges (JSON)
• Bing: Verifying Bingbot
• OpenAI: Overview of OpenAI crawlers