Most ‘AI crawlers’ are exactly who they claim. Some are impostors.

The single biggest source of AI-crawler traffic was ChatGPT-User — the fetch that fires the moment a person asks ChatGPT something and it goes to read a page. It was 68% of everything, and 95.5% of it verified genuine. The training crawler everyone is told to block, GPTBot, was just 7%.

The lesson: block the training bots and you can still be starving the live retrieval that actually puts you in front of a person mid-question.

Among crawlers that publish a footprint we can check, PerplexityBot had the highest impostor rate by far: of 113 visits presenting the PerplexityBot user-agent, 70 (62%) came from IPs outside Perplexity's published ranges. Our method can't tell you why — it could be third parties spoofing the name, or the operator using undisclosed addresses — only that the network identity didn't match the claim.

This does not stand alone. In August 2025 Cloudflare publicly reported that Perplexity used “stealth, undeclared crawlers” with rotating IPs across networks to reach content that had blocked its declared bots, and delisted it as a Verified Bot. Perplexity's reply was that a user-initiated request made through an AI assistant is not the same thing as a crawler. Our figure sits alongside that debate as one more independent measurement, not a verdict on intent.

The tell was consistent: 83% of impostor traffic came from IPs with no reverse DNS at all — 425 of 514 hits — with the rest hiding behind cloud providers such as AWS and Google Cloud. Genuine operators run their crawlers from address space they publish and that reverse-resolves to their own domain. Traffic that borrows an AI brand's name but answers to no network is exactly the pattern a spoof leaves behind. Nearly all impostors (497 of 514) failed on the unspoofable test: the IP simply was not in the range the operator publishes.

If you read your server logs, a line that says “GPTBot” or “PerplexityBot” looks like proof an AI read your page. It isn't. A user-agent is just a label any script can type. Here's the honest picture from actually checking:

• Most AI crawlers are real — a bit over three in four proved their identity by network. That's the reassuring part.
• About 1 in 20 is an impostor — wearing an AI brand's name from an address that brand never published. Block, rate-limit or trust a bot on the label alone and you're acting on a claim, not a fact.
• A chunk can't be judged at all — some crawlers publish nothing to check them against, so an honest system flags them rather than accusing them.
• The verdict lives in the network, not the log line — published IP ranges and forward-confirmed reverse DNS turn a claim into proof.

The takeaway: don't take a crawler's word for who it is any more than you'd take an AI answer's word for its sources. Verify the visitor, then trust the log — never the other way round. Turning that user-agent claim into proof is exactly what Unsourced does on your own site.