Is this IP really ClaudeBot?

A user agent is a free-text header the client chooses. Anyone can send “Googlebot” or “GPTBot” with one command, so scrapers routinely borrow the names of crawlers that sites allow. Only the IP address, checked against what the operator itself publishes, tells you who really sent the request.

In one of two ways. Most publish a range file: a JSON or text list of CIDR blocks at a fixed URL (for example openai.com/gptbot.json or Google’s common-crawlers.json). Others document a reverse-DNS convention: the address’s PTR hostname must end in their domain, and that hostname must resolve back to the same address.

We look up the PTR record of the address, check that the hostname ends in a domain the operator documents, then resolve that hostname and require the original address in the answer. A PTR record alone proves nothing, because whoever controls an IP block can set its PTR to any name.

Yes. The verdict is read from the same in-memory catalogue that sets risk.is_ai, risk.is_crawler and risk.is_scanner in the lookup API, covering 143 operators. One difference: the API can also match a few scanner networks by the ASN its geolocation providers return; this tool does not run a provider lookup.

Either the reverse-DNS check timed out or failed, or the operator’s published list is currently unavailable to us. We never fall back to an old copy: every source is re-fetched at least hourly and its evidence expires within 24 hours if refreshes keep failing. Try again in a minute.

No. It means no operator we track claims the address. Plenty of automated traffic comes from cloud and residential networks that nobody publishes.