That "GPTBot" in your logs might be fake — how to spot spoofed AI crawlers

Here's an uncomfortable fact about every "AI traffic report" built on server logs: the user-agent header is self-declared. One line of code makes any scraper introduce itself as GPTBot:

curl -A "Mozilla/5.0 ... GPTBot/1.2" https://yoursite.com/

And scrapers have a reason to wear the costume. Sites increasingly allowlist known AI crawlers (for GEO visibility) while rate-limiting anonymous bots — so pretending to be GPTBot is a free pass. It also poisons your data in the other direction: you might "measure" heavy AI-crawler interest that's actually one aggressive scraper in a mask.

How verification actually works

Every major AI vendor publishes the IP ranges its crawlers operate from — OpenAI, Anthropic, Google, Microsoft, Perplexity, and Apple all maintain public lists (JSON files or documented ranges). Verification is a two-step check:

1. Claim: the user agent says "I am GPTBot."
2. Evidence: is the request's IP inside OpenAI's published GPTBot ranges?

Claim + matching network = verified. Claim + wrong network = spoof. There's no gray area: a real GPTBot request cannot come from a residential ISP in another country.

What to do with a spoof

Don't panic-block — reclassify. A failed verification tells you it's a plain bot, so treat it with plain-bot rules (rate limits, no analytics pollution, no "AI interest" credit). The useful part is what it removes: your AI-traffic numbers stop being inflated by impostors, and decisions like "should we allow GPTBot?" get made on real data.

Where VisitorType fits

VisitorType does this check on every claimed agent visit, automatically — around 2,500 published vendor IP ranges, refreshed as vendors update them. Verified visits get a ✓ badge in your analytics; failed claims are downgraded to "bot" with the reason recorded, so they never pollute your AI metrics. When a new agent first appears on your site, the alert tells you whether it was verified before you react to it.

Curious how much of "GPTBot" in your logs is real? Create a free account — the verification badge does the arguing for you.