This tool verifies whether a request claiming to be from a known AI crawler is genuine, using three methods.
Some operators publish the IP ranges their crawlers operate from as a machine-readable file. Given a request claiming to be GPTBot and its source IP, we check that IP against OpenAI's published CIDR blocks. A match confirms the request originated from OpenAI's infrastructure.
Verifiable this way: GPTBot, OAI-SearchBot, ChatGPT-User, OAI-AdsBot, ClaudeBot, Claude-SearchBot, Claude-User, PerplexityBot, Perplexity-User, Googlebot, GoogleOther, Googlebot News, GoogleOther-Image, GoogleOther-Video, Google-CloudVertexBot, Bingbot, Applebot. Those files are fetched live on every build rather than copied into this site, because operators revise them without notice.
Some operators document reverse DNS as a verification path: the source IP resolves backward (rDNS) to a hostname on a domain they own, which then resolves forward (DNS) back to the same IP. This forward-confirmed reverse lookup proves the operator controls that address. A reverse lookup on its own does not, because rDNS records are set by whoever controls the address block being queried.
Documented for: Googlebot, GoogleOther, Googlebot News, GoogleOther-Image, GoogleOther-Video, Google-CloudVertexBot, Applebot, CCBot. Common Crawl publishes the hostname pattern
*.crawl.commoncrawl.org and states that reverse DNS is not yet
supported over IPv6, so IPv6 requests claiming to be CCBot have no verification
path at all.
The emerging Web Bot Auth standard allows crawlers to sign their requests with cryptographic signatures keyed to the IANA Signature Agent Card registry. This method is tracked in production but is not yet asserted in this prototype without primary source data.
This tool verifies self-identified crawlers only. If a request's User-Agent string claims to be GPTBot, we check that claim. We cannot unmask stealth bots posing as human browsers, nor can we verify crawlers that publish no IP ranges, DNS records, or signatures.
These crawlers publish no verification method of any kind, so a request claiming to be one of them cannot be proven genuine by anyone: AdIdxBot, Meta-ExternalAgent, Meta-ExternalFetcher, Meta-WebIndexer, Meta-ExternalAds, FacebookExternalHit. The User-Agent string alone is unverifiable. Control tokens such as Google-Extended and Applebot-Extended are excluded from that list because they never make requests at all, so there is nothing to verify.
Every source URL behind these methods is fetched and checked on each build. The result of that check, including which published files have moved, broken, or changed contents, is published at /sources.
All verification checks run in your browser. No IP addresses, User-Agent strings, or request details are uploaded to our servers or any third party. The tool computes results locally against embedded IP ranges or performs DNS lookups you initiate.