Bot traffic can mess up your stats — annoying at best and actively disruptive at worst.
Some are benign, like ones sent out by search engines or competitive intelligence tools.
Some aren’t — like bots which actively want to break through your site’s defences and steal your users’ personal information.
If you’re interested in learning more about bots and how they can mess with your traffic, check out our recent article on it.
The issue here is that while malicious bots can easily be blocked if it’s clear that’s what they are, malicious actors don’t usually name their bots “DNS Attacker 3000”.
Instead, they make sure they appear as just your everyday, innocent bot, like “GoogleBot” or “GPTBot.”
And that’s what we’ve just solved.
What the issue was
The bot’s name — represented as the “User-Agent header” — is just a string the client sends as part of their bot’s description. Anyone can write whatever they want in there. So a malicious actor writes “Googlebot,” and boom — your analytics say Google visited. Perfectly harmless, right?
It’s the equivalent of writing “Doctor” on a t-shirt and walking into surgery.
Not ideal.
How we fixed it
We look at IPs now. Simple, but incredibly effective.
Companies with legitimate crawlers publish a list of confirmed legitimate IPs. All we’re doing is referencing that.
If the IPs match, then the bot gets factored into your statistics as usual (unless you choose to block them anyway — find out how here).
If the IPs don’t match? Then that bot’s IP gets flagged as fraudulent.
Impostors will appear in your stats as “FakeGoogle”, “FakeBing”, and “FakeOpenAI” — so you know exactly who’s pretending to be who.
Why you should care
If you’re just seeing “Google” everywhere and assuming that your link is performing well on the search engine, you’re flying blind.
Similarly, someone might be targeting you specifically while you remain completely oblivious to it.
With the new bot detection, you can tell the difference at a glance.
A spike in “FakeGoogle” means someone’s actively pretending to be Google to get past your defenses — and that’s worth paying attention to.
Head into your stats and have a look. If you see impostors, you’ll know.
If you don’t — even better.