I checked my nginx log for AI crawlers. A third of the “Googlebots” were fake

I went through two weeks of my site's nginx access log and counted every bot that said it was an AI crawler or a search engine. I only kept requests whose IP address really belongs to the company behind the bot.

AI crawlers made 1,590 verified requests. All search engines together made 563. Meta's crawler and ClaudeBot each read the site more often than Googlebot did.

None of this shows up in Plausible, Umami or Google Analytics. These bots don't run JavaScript, so the tracking script never fires. The server log is the only place you see them.

The part that surprised me was the fakes.

119 of 331 requests signed "Googlebot" came from rented Google Cloud servers, not from Google. Five servers used 30 bot names between them, including ChatGPT-User and Claude-User. Four of them first read the homepage, robots.txt and about 15 articles like a polite crawler. Then they asked for .env files, cloud keys and Git folders. That's 1,045 requests for secret files, and the server refused them all.

Two quick checks if you run your own server:

• A real Googlebot resolves to a name ending in googlebot.com. Reverse DNS catches these fakes in seconds.
• Make sure your server returns 403 for .env and similar files. robots.txt won't stop a bot that lies about its name.

I also looked for visitors arriving from ChatGPT, Perplexity, Claude or Gemini. In two weeks there were none.

I put the full write-up on my blog, opensource-analytics.com, with all the charts, the three jobs AI bots do on a site and how I verified each one.