Bot User-Agent & IP Verifier
Paste a user agent, an IP address, or both. We identify the bot from the Kitbase registry and check the IP against the operator's published ranges — so you know whether that Googlebot, GPTBot or ClaudeBot hit was real or spoofed.
How it works
Paste a user agent, an IP, or both
Copy them straight from your access logs, your CDN's request log, or a request header your app received.
We match and verify
The user agent is matched against the Kitbase bot registry; the IP is checked against the operator's published ranges and reverse DNS.
Get a verified / spoofed verdict
With both signals we tell you whether the request is genuinely from that bot, an impostor, or an unverifiable crawler.
Why a user agent alone proves nothing
The user agent is a free-text header. Anyone can send
Googlebot/2.1 and many scrapers do exactly that, because sites tend to let search engines
through. Identifying a bot from its user agent tells you what it
claims to be. Verifying it means checking that claim against
something the impostor cannot fake. Reputable operators give you three
ways to do that.
Published IP ranges
Google, OpenAI, Anthropic, Microsoft, Apple and others publish JSON files listing every prefix their crawlers use. If the request's IP is inside the list, it's genuine; if not, it's spoofed. This is the fastest check and the one this tool leans on first.
Forward-confirmed reverse DNS
Look up the IP's PTR record, check the hostname ends in the operator's domain (for example .googlebot.com), then resolve that hostname forward and confirm it comes back to the same IP. Older but still authoritative for Googlebot and Bingbot.
Web Bot Auth signatures
The newest method: the crawler cryptographically signs each request (RFC 9421) with a key it publishes in a well-known directory. No IP lists to keep fresh, and it works from any network. How Web Bot Auth works →
A bot whose operator offers none of these can be identified but never verified — that's what the tool calls a suspected bot. The full verification recipe for every crawler we track is on its page in the bot directory.
Where to find the user agent and IP
Every request that reaches your server carries both. Where you read them from depends on your stack:
- Server access logs — Nginx and Apache combined-log lines put the client IP first and the quoted user agent last. Copy each straight out of the line.
- CDN and hosting dashboards — Cloudflare's Security Events and Logpush, Vercel's request logs, and Fastly's real-time logs all show the user agent and the original client IP per request.
- Application code — in Node it's
req.headers['user-agent']; the IP is req.ip or the first entry of X-Forwarded-For when a proxy is in front.
Mind the proxies. If your app runs behind a load balancer, CDN or reverse proxy, the connecting address you see is the proxy's, not the visitor's. Use the forwarded client IP ( X-Forwarded-For, CF-Connecting-IP, True-Client-IP) — verifying your own edge's IP will always come back unverified.
Doing this by hand for one suspicious line is fine. Doing it for every request is what Kitbase bot analytics is for: it runs the same verification on live traffic and reports genuine crawlers, impostors and unverified bots separately.
Frequently asked questions
Is this IP really Googlebot?
Paste the Googlebot user agent together with the IP. Google publishes the exact IP ranges Googlebot crawls from and every genuine hit also has a forward-confirmed reverse DNS name under googlebot.com or google.com. If the IP is inside those ranges the tool reports a verified bot; if the user agent says Googlebot but the IP is outside them, it reports a spoofed bot.
Why does it say “spoofed”?
The user agent claims to be a bot whose operator publishes a way to verify it — IP ranges, reverse DNS or a Web Bot Auth key — and the IP you gave fails that check. Anyone can put “Googlebot” or “GPTBot” in a request header; the IP is what proves it. Scrapers commonly borrow a search-engine user agent to slip past allow-lists.
What does “suspected bot” mean?
The user agent identifies a bot, but its operator publishes no IP ranges, reverse-DNS suffix or signing key, so there is nothing to verify the request against. Many smaller crawlers and SEO tools fall into this bucket. It isn't an accusation — it just means the identity can't be confirmed either way.
Do you log what I paste?
Not the user agent or IP you paste — those are third parties' data and are never stored. We do record that a lookup happened and its verdict (for example "verified Googlebot"), so we can see how the tool is used. Results are not cached; the only copy of what you pasted is the shareable link in your address bar, which you can clear.
What if the bot isn't in your registry?
The curated bot directory covers the crawlers that matter for SEO and AI visibility, and a long-tail rule set recognises thousands more by user-agent pattern. If a real crawler still comes back unknown, tell us through the contact page and we will add it.
How fresh are the IP ranges?
Operators such as Google, OpenAI, Anthropic, Microsoft and Apple publish their ranges as JSON files. Kitbase re-fetches them on a schedule, and the IP card shows when they were last refreshed so you can judge for yourself.
Can I verify a Web Bot Auth signature here?
Not yet. Web Bot Auth (RFC 9421) signs the whole request, so verifying it needs the full set of request headers rather than just the user agent and IP. Kitbase's bot analytics verifies signatures on live traffic; this tool covers the two signals you can paste from a log line.
Which IP should I use if my site sits behind a proxy or CDN?
The original client IP, not the address of your load balancer or CDN edge. Look for X-Forwarded-For (first hop), CF-Connecting-IP on Cloudflare, or the client IP field in your platform's request logs. Verifying your own proxy's IP will always come back unverified.
More free tools
All tools →AI Crawler Access Checker
See which AI crawlers your robots.txt and firewall let in — bot by bot.
llms.txt Generator
Build a spec-compliant llms.txt from your sitemap in a minute.
llms.txt Checker
Validate your llms.txt against the spec and catch the usual mistakes.
AI Citation Preview
See how a page reads to Google, social cards and AI answer engines.
Stop checking by hand. Kitbase watches this for you.
Bot & Crawler Analytics runs continuously on your real traffic and your real pages — with alerts when something changes, not when you remember to look.