Skip to main content
Anyone can send a request with GPTBot in its user agent. To tell genuine crawlers from impersonators, RankRaft AI checks the IP address of every crawler hit against the IP ranges the provider publishes.

​
Verification states

Human visits and AI referrals don’t have a verification state.

​
Providers with published ranges

RankRaft AI refreshes these lists every day. If a provider’s list can’t be fetched, the previous day’s list stays in use. Every other provider, including Anthropic, Meta, Apple and Amazon, publishes no machine-readable IP ranges. Their crawlers are always Partial.
Anthropic publishes no IP ranges, so ClaudeBot, Claude-User and Claude-SearchBot will always show 0% in the Verified column. That is expected and doesn’t mean the traffic is fake.

​
Reading the Verified column

The AI bots on your site table on the Bots page shows the percentage of each bot’s hits that were verified. To see only impersonators, open the Request log and set Verification to Spoofed.

​
Why genuine crawlers can show as Spoofed

Verification needs the visitor’s real IP address. If your integration reports the IP of a proxy, load balancer or CDN instead, every crawler from a provider with published ranges will look spoofed.
  • Cloudflare Worker: uses CF-Connecting-IP, so this doesn’t happen.
  • WordPress behind Cloudflare: handled automatically.
  • WordPress behind another CDN or load balancer: add the proxy’s addresses with the rankraft_aa_trusted_proxies filter. See Security and privacy.
  • Server logs: send the client IP from X-Forwarded-For or your proxy’s real-IP header in the ip field, not the proxy’s address.

​
Dropping spoofed traffic

Spoofed hits are stored by default so you can see who is impersonating AI crawlers. They are still counted in your daily totals either way.