Is this AI bot real?

What the answer means

Verified: the request matches what the operator publishes for that agent, so it is the real one.

Spoofed: it claims to be a known agent, and the operator's own published information proves it is not. Treat it as an impostor; scanners and scrapers often borrow the names of OpenAI, Anthropic or Google.

Unverified: the operator publishes nothing that could confirm or deny it, or the request did not include what is needed. That is not the same as fake.

Why fake AI bots matter

On a business website we measured for a week, 1,372 requests used the names of Google, OpenAI or Anthropic without being them, against 761 real, verified agent requests. If you allow or block agents by name in robots.txt or a firewall, impostors get the same treatment as the real thing.

Checking one request here helps when you see something odd in a log. To check every request automatically, connect your site to Knocklog: every visit is verified as it arrives, with the agent, the page and the verdict in your report.

Questions

How do I verify that GPTBot is really OpenAI?

Take the IP address of the request and check it against what OpenAI publishes for GPTBot. This tool does that for GPTBot and for every other agent in the Knocklog directory, using each operator's own published information.

How do I verify Googlebot?

Google publishes how to confirm Googlebot. Paste the user agent and the IP address here and Knocklog applies Google's own method.

Is a bot that claims to be ChatGPT always OpenAI?

No. Any program can send "ChatGPT-User" in its user agent. Only the checks the operator publishes can confirm it.

Can I verify every request automatically?

Yes. Create a free Knocklog project and connect your site (Cloudflare, WordPress, cPanel hosting, Vercel, Node.js or log import). Every request is verified as it arrives.