Googlebot Impersonation

Internet Sage Chris Siebenmann wrote of a Plague of Googlebot Impersonation on his amazing Wandering Thoughts blog. I decided to find out if I could detect such a plague in this blog’s Apache log files.

Apache “combined” format log files have an IP address and a user agent in them. When Siebenmann wrote of “Googlebot impersonators”, I believe he meant HTTP requests from IP addresses not in one of Google’s advertised CIDR ranges that have a user agent indicating that Googlebot made the request. That suggests a procedure to see if my blog is suffering from the same plague.

1. Get Google’s IP address CIDR ranges.
2. Filter out timestamps and IP addresses from my blog’s Apache log files that have a Googlebot user agent.
3. Divide the timestamps and IP addresses into google and not google.
4. Create a visualization of rate of requests for the two categories using the timestamps.

Google offers a handy URL in the user agent strings that Googlebot uses: http://www.google.com/bot.html . From this handy URL we can get all of Google’s IP address ranges.

I ended up writing a little program to do step (3).

Between 2025-03-13T00:01:18Z and 2026-07-23T23:53:26Z, I found 88581 HTTP requests with user agent strings that purport to be Googlebot. I merely grepped for oogleBot in my log files, I wasn’t sophisticated. I found 3889 unique IP addresses that claimed to be GoogleBot. After fetching all of Google’s IP ranges, and running my CIDR membership program, I found 74775 or the HTTP requests had a Google IP address, and 13806 that did not.

There’s a low background rate of GoogleBot impersonators all through my blog’s log files, less than 100 HTTP requests per day, until 2026-06-10, when 1063 impostors make requests. After June 10th, there are days of about 1500, 2026-06-23, 2026-07-03, 2026-07-05, 2026-07-11, but mostly there are still less than 100 HTTP requests per day.

I have no idea why True GoogleBot requests are so high between 2025-11-01 and 2026-01-01.

Biggest Fakers

IP address	Requests	Organization
185.196.220.113	110	Colocatel Inc.
196.251.70.180	173	cheapy.host
2a0f:ca80::49	267	ColocaTel Inc.
193.142.147.5	306	ColocaTel Inc.
151.243.150.23	1032	DEDIK SERVICES LIMITED
151.243.150.222	1539	DEDIK SERVICES LIMITED
91.92.33.248	2143	DEDIK SERVICES LIMITED
87.58.199.37	2901	DEDIK SERVICES LIMITED

The above organizations are from Seychelles (Colocatel Inc), from a US company with addresses allocated via AFRINIC, but the most requests are from a UK company. Siebenmann says his Googlebot impersonators all come from “a rogue’s gallery of places that I was already having problems”. He mentions several hosting providers that I don’t see as major GoogleBot impersonators. In fact, DEDIK SERVICES LIMITED seems like the only big impersonator.

The company info for DEDIK SERVICES LIMITED makes it seem like a one-person enterprise.

The five large-number-of-requests days, 2026-06-10, 2026-06-23, 2026-07-03, 2026-07-05 and 2026-07-11, are the only five days DEDIK SERVICES IP addresses make requests. DEDIK SERVICES IP addresses don’t throttle their requests at all: all the DEDIK IP address requests arrive within short intervals of 30 to 60 minutes on each of the days.

What the impersonators ask for

The GoogleBot impersonators do seem to be nosing around for misconfigurations, URLs with .env, /wp-config.bak /.ssh/id_ed25519.key and the like. The impersonators are also interested in WordPress “author” pages, URLs like /?author=1, /?author=2, /?author=3 and so on. They also ask for a number of garbage, randomly-generated URLs from my infinite website generator.

DEDIK SERVICES IP addresses only ask for misconfigurations, .env or .yaml files, Kubernetes “Secret” files, and a complete set of key files commonly found in .ssh/ directories. They’re fishing, they don’t ask for any blog posts or tag indexes.

The other impersonators aren’t only interested in low-grade cybercrime. They also ask for a large slice of blog posts and indexes. In fact, they ask for robots.txt and my TFTP Honey Pot results post most often.

The impersonators do ask for /css/style.css and /js/menu.js a few times, which may indicate that every once in a while, humans run actual browsers. The referer values for these requests are nonsensical, so maybe not. Real GoogleBots also ask for those files, but send believable referer values.

Conclusion

I judge Chris Siebenmann to be mostly correct: beginning June 2026, there’s a plague of GoogleBot impersonators. My blog’s Apache server doesn’t record the same plague he saw, it only records a few IP addresses from a single company doing most of the impersonation. His idea of blocking all request that have GoogleBot user agents may be useful, given how little traffic Google sends. Since I had all my Apache log files close to hand, I counted 116,399 referrers mentioning “google.com” out of roughly 36 million log file lines: 0.3% .

It may be worthwhile to create otherwise unused ssh key files to give out to IP addresses that run misconfiguration seines like DEDIK SERVICES does. That might waste more of their time and lower their morale.

I should also consider adding CIDR membership to my Apache combined format log file examiner.