AI Crawler IP Verifier
Found a suspicious hit from "GPTBot" or "ClaudeBot" in your server logs? User-agent strings are trivially spoofable — anyone can send that header. Paste the IP address and pick the bot it claims to be, and this tool checks it the way Google, OpenAI, Anthropic, Apple and Amazon themselves document: Forward-Confirmed Reverse DNS.
How this check works
- The IP must be a syntactically valid, publicly routable address — private and reserved ranges are rejected outright.
- A reverse DNS (PTR) lookup runs on the IP. No PTR record at all means the result is "unverified".
- If a hostname resolves, it's checked against the claimed bot's documented verification domains. A mismatch means "spoofed".
- If the hostname matches, a forward DNS lookup on that hostname must resolve back to the original IP. That's the "confirmed" half of FCrDNS — matching without this step means "spoofed" too.
- Some bots have no documented reverse-DNS scheme at all — those always return "not supported" regardless of DNS, rather than a guess.
Frequently asked questions
Why can’t I just trust the User-Agent header?
Any script can send `User-Agent: GPTBot` (or any other bot's exact string) — the header is just text the requester chooses to send, with nothing to stop it lying. Scrapers, spam bots, and competitors routinely spoof well-known crawler user-agents specifically to get past robots.txt rules and access logs that only check the header. Forward-Confirmed Reverse DNS (FCrDNS) checks something the requester can't fake: what the network actually says about the IP address the request came from.
What is Forward-Confirmed Reverse DNS (FCrDNS)?
A two-step check. First, a reverse DNS (PTR) lookup on the IP returns a hostname — if that hostname ends in a domain the claimed vendor actually owns (e.g. "crawl-66-249-66-1.googlebot.com" for Google), that is a hint. Second, a forward DNS lookup on that hostname must resolve back to the exact same original IP — the "confirmation" step. Both directions have to agree. This is the same method Google, OpenAI, Anthropic, Apple and Amazon each document in their own crawler-verification guides, precisely because it can’t be spoofed by controlling only one direction of DNS.
Why are some bots marked "not independently verifiable"?
A handful of vendors — Meta's Meta-ExternalAgent/Meta-ExternalFetcher, ByteDance's Bytespider, Common Crawl's CCBot, Cohere, Mistral, DuckDuckGo's DuckAssistBot, Diffbot, and xAI — don't publish a reverse-DNS verification scheme or a maintained IP-range feed for these specific bots. For those, this tool is honest that it can't confirm or deny anything by hostname, rather than guessing at a domain that was never actually documented.
Why would a real crawler request fail this check?
A false 'spoofed' result usually means the hostname genuinely doesn't belong to the claimed vendor — but a stale local DNS cache, a very recently reassigned IP block, or a vendor mid-migration to new infrastructure can occasionally cause a real crawler to fail forward-confirmation. If you see this from an IP with a long, consistent crawl history from the claimed vendor, it's worth re-checking a few minutes later before concluding it's spoofed.
Is this tool free?
Yes — paste an IP and pick a bot, no signup or email required.
This is one check from KinetixSEO's full SEO/GEO audit — which also checks whether your own robots.txt allows or blocks these same AI crawlers. Try the free AI Crawler Checker.