AI Crawler IP Verifier
This tool confirms whether an IP address claiming to be GPTBot, ClaudeBot, or another AI crawler is genuine, using the same Forward-Confirmed Reverse DNS (FCrDNS) method Google, OpenAI, Anthropic, Apple and Amazon document for verifying their own crawlers. User-agent strings are trivially spoofable, since anyone can send a User-Agent header naming GPTBot regardless of who they actually are, so a suspicious hit in your server logs claiming to be an AI crawler cannot be trusted by that header alone. Paste the IP address from your logs and pick the bot it claims to be, and this tool runs the two-step DNS check instead of taking the header's word for it.
How this check works
- The IP must be a syntactically valid, publicly routable address — private and reserved ranges are rejected outright.
- A reverse DNS (PTR) lookup runs on the IP. No PTR record at all means the result is "unverified".
- If a hostname resolves, it's checked against the claimed bot's documented verification domains. A mismatch means "spoofed".
- If the hostname matches, a forward DNS lookup on that hostname must resolve back to the original IP. That's the "confirmed" half of FCrDNS — matching without this step means "spoofed" too.
- Some bots have no documented reverse-DNS scheme at all — those always return "not supported" regardless of DNS, rather than a guess.
Frequently asked questions
Why can’t I just trust the User-Agent header?
No, because the User-Agent header is plain text the requester chooses to send, and nothing forces it to be truthful. Any script can send a User-Agent header naming GPTBot or ClaudeBot without running a single line of code from OpenAI or Anthropic, since it is one HTTP header, set by whoever wrote the request. Scrapers, comment spam bots, and competitors spoof well-known crawler names specifically to slip past robots.txt rules and to make server logs look like they were crawled by a real AI vendor rather than an anonymous scraper. Forward-Confirmed Reverse DNS (FCrDNS) checks something the header cannot touch: what the internet's own DNS records say about the IP address the request actually came from. That requires controlling both a reverse DNS entry and the matching forward DNS record on infrastructure the claimed vendor owns, something a spoofed User-Agent header alone cannot produce, no matter what string it sends.
What is Forward-Confirmed Reverse DNS (FCrDNS)?
FCrDNS is a two-step DNS check that confirms an IP address controls the hostname it claims to, rather than trusting a claim on its own. First, a reverse DNS (PTR) lookup on the IP returns a hostname; a real Googlebot request returns a hostname such as "crawl-66-249-66-1.googlebot.com", ending in a domain Google actually owns. On its own that hostname is only a hint, since PTR records can be set to say almost anything. Second, a forward DNS lookup on that same hostname must resolve back to the exact original IP, the "confirmation" half of FCrDNS. Only when both directions agree does the check pass. This is the same method Google, OpenAI, Anthropic, Apple and Amazon document in their own crawler-verification guides, because spoofing it requires controlling DNS in both directions at once, not just a single fake User-Agent header or a one-way PTR record.
Why are some bots marked "not independently verifiable"?
Those bots are marked "not independently verifiable" because their vendors have not published a reverse-DNS verification scheme or a maintained IP-range feed for that specific crawler, so there is no documented hostname pattern to check against. That group currently includes Meta's Meta-ExternalAgent and Meta-ExternalFetcher, ByteDance's Bytespider, Common Crawl's CCBot, Cohere, Mistral, DuckDuckGo's DuckAssistBot, Diffbot, and xAI's crawler. Compare that with GPTBot, ClaudeBot, Googlebot-related agents, PerplexityBot, and bingbot, each of which has a vendor-published PTR domain this tool can check in both directions. Rather than guess at a plausible-looking domain the vendor never actually documented, and risk returning a false "verified" or "spoofed" result, this tool marks those bots "not supported" and says so directly. An undocumented scheme is not proof the traffic is fake; it means the claim cannot be checked by hostname today, and that limitation is stated rather than papered over with a guess.
Why would a real crawler request fail this check?
A "spoofed" result usually means the hostname genuinely does not belong to the claimed vendor, but three specific conditions can cause a real crawler to fail forward-confirmation without being fake. A stale local DNS cache can return an outdated PTR record for an IP the vendor already reassigned. A recently reassigned IP block can carry forward DNS records from its previous owner until the new owner's records propagate. And a vendor mid-migration to new crawling infrastructure can briefly operate on IP ranges its own DNS records have not caught up to yet. If a failed check comes from an IP with a long, consistent crawl history under the claimed vendor's name, re-run the check a few minutes later before concluding the traffic is spoofed, since DNS propagation delays resolve within minutes to hours, not days. A hostname mismatch that persists after re-checking is the stronger signal of genuine spoofing.
Is this tool free?
Yes. Paste an IP and pick a bot, no signup or email required.
This is one check from KinetixSEO's full SEO/GEO audit, which also checks whether your own robots.txt allows or blocks these same AI crawlers. Try the free AI Crawler Checker.