# Spoofed crawler > A spoofed crawler is any request that claims a crawler's identity in its user-agent header without belonging to that operator. Because the header is a plain string the client chooses, `curl -A "GPTBot"` is enough to make one — which is why an AI traffic report that trusts the header is a report anyone can inflate. **Category:** Verification **Also known as:** fake crawler, crawler impersonation, user-agent spoofing **Updated:** 2026-09-09 **Source:** https://truestat.io/glossary/spoofed-crawler --- ## Three verdicts, not two Most tools report verification as a tick or nothing. That merges two findings that mean very different things, and the merge always hides the more interesting one. **Verified** — the address matched what the operator publishes, or survived forward-confirmed reverse DNS. This really was them. **Unverified** — we could not confirm it, and that is the whole claim. The operator may publish nothing to check against, a published list may be behind the addresses actually in use, or DNS may have been slow. It is not an accusation. **Spoofed** — the address belongs to somebody else. Its own reverse DNS record resolves to a different owner, which is positive evidence of a forgery rather than a failure to find evidence. A product that cannot separate the second from the third has one answer for both, and it is the wrong answer for whichever case you are actually in. ## Who spoofs, and why Scrapers, mostly, and the motive is boring: a crawler user agent gets past filters that a generic HTTP client does not. A site that rate-limits unknown clients but waves through `Googlebot` has told everyone exactly what to send. The second group is more relevant to anyone reading an AI traffic report. A competitor, a vendor running a demo, or a curious developer can inflate somebody's AI numbers with a loop and a header. It costs nothing and leaves no trace in a report that trusts the string. ## What it means for a number you are about to show somebody This is the practical point. If you are putting "ChatGPT read our documentation four hundred times last month" in a board deck, the question that follows is how you know. An unverified count cannot answer it. The useful framing is that verification turns a metric into evidence. The count itself is the same either way; what changes is whether it survives the first sceptical question. ## How much of it there is Nobody has a trustworthy public number, and the ones that circulate are usually measuring something else — total bot traffic, or blocked requests, which include far more than impersonation. What can be said from our own data: on a site with ordinary traffic, requests carrying a crawler token from an address that resolves to somebody else are a small fraction of crawler traffic, and they cluster. They arrive in bursts from one or two networks rather than trickling in, which is what you would expect if the source is a scraper working through a list of sites rather than a broad background of casual forgery. The practical consequence is that the ratio matters more than the count. A handful of spoofed requests is background noise on the open internet. A single operator whose verified share collapses from one month to the next is either being impersonated deliberately or has changed its infrastructure without publishing the new addresses — and those two look identical from outside, which is why the verdict is `unverified` rather than an accusation. ## What goes wrong - Reading `unverified` as suspicious. For operators that publish nothing — Meta, ByteDance, xAI — it is the honest ceiling and says nothing about the individual request. - Blocking on the user agent alone. A spoofer changes one string; the real crawler you meant to keep does not. - Assuming a verified count is a complete count. Verification confirms the requests you saw; it does not find the ones that arrived looking like a browser. ## Worth doing - Compare verified against total per operator rather than in aggregate — a single operator whose ratio collapses is the signal worth chasing. - Treat a spoofed verdict as worth reading, not worth panicking over. A handful is background noise on the open internet. ## Questions ### How common is crawler spoofing? Common enough that any site large enough to be scraped will see some, and rare enough that it is usually a small fraction of crawler traffic. The reason to check is not the volume — it is that an unchecked report cannot tell you the volume. ### Does blocking a user agent stop a spoofer? No. A spoofer picks the string; if one is blocked they send another, or send a browser's. Blocking by user agent works on crawlers that honour the block, which is the opposite population. ### Can an agentic browser be detected this way? No, and this is the real limit. ChatGPT Atlas and Perplexity Comet drive an actual browser and send an ordinary Chrome user agent. There is nothing to verify because nothing is being claimed — no user-agent-based product can separate them from a person, ours included. ## Related - https://truestat.io/glossary/fcrdns - https://truestat.io/glossary/user-agent - https://truestat.io/glossary/bot-filtering --- From the TrueStat glossary — https://truestat.io/glossary. Privacy-first web analytics that also shows you which AI assistants are reading your site.