Server logs reveal AI crawlers outnumber search bots, and a third of 'Googlebot' traffic is fake

A website owner reviewed two weeks of nginx access logs, keeping only bot requests whose IP addresses genuinely belonged to the companies behind them. Verified AI crawlers made 1,590 requests, more than all search engines combined at 563, with Meta's crawler and ClaudeBot visiting more often than Googlebot. Common analytics tools missed this activity because these bots do not run JavaScript, so only server logs captured it. Of 331 requests claiming to be Googlebot, 119 came from rented Google Cloud servers rather than Google, and some of these impostor bots attempted to access secret files such as .env files and cloud keys, all of which the server blocked. The author recommends reverse DNS checks to identify fake Googlebots and returning 403 errors for sensitive files, noting that robots.txt cannot stop bots that misrepresent themselves.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in