The robot that swore it was Google
Every automated visitor shows up with a calling card: “I am Googlebot.” For a long time, the tower sorted its visitors by that card. Then we found, in our own logs, a “Googlebot” hunting for configuration files. The card is free text. We stopped believing it.
1. The calling card is free text
When a machine requests a page, it sends a sentence saying who it is.
That sentence is not signed, not controlled, not reserved: any
three-line program can write Googlebot/2.1 in it.
Disguising yourself as Google's robot is even a rational choice for an
attacker — sites hesitate to block Google, afraid of vanishing from
search results.
Our logs keep the proof: a visitor carrying that card requested server diagnostic pages that no search engine ever asks for. The real Google files articles away; that one was looking for badly closed doors.
2. The round trip through the internet's directory
The counter is not artificial intelligence. It is a round trip through the public directory of the internet, the one that links addresses to names. First leg: from the visitor's address, walk up to its machine name. If the card says Google but the name does not end at Google, the lie is already visible. Second leg, the important one: from that name, walk back down to the address — and it must return exactly the visitor's address. Without that return trip, a liar could lie about its machine name too.
Some publishers also publish the official list of their robots' addresses. We check that too. And when a robot has neither directory nor list, we record it honestly: unverifiable. We can neither believe it nor accuse it.
3. Three verdicts, not two
Each visit therefore gets a verdict: true — its address confirms its name; fake — its address says otherwise, it is lying; unverifiable — that name has no official directory. The third verdict is the one that costs the most discipline. The temptation is to melt it into one of the other two. But “I cannot decide” is information, not an admission of weakness.
Over the measured period, every major search engine that showed up passed the test. No liar that day. The verdict runs again at every analysis though: the day a fake Google shows up, it will come out in red, on its own, without anyone having to think about it.
4. What it changes
Before, the question “who visits the site?” got a phone-book answer: the list of declared names. That was an answer on trust. Now it is an answer on proof: the declared name, AND what the directory says about it. The difference looks thin. It is exactly the one that separates “he told me he was a police officer” from “I checked his badge.”
- A name is not an identity. It is written by the one introducing itself, not by an authority.
- The check is deterministic: a round trip through a public directory. No model, no hunch, no guessing.
- “Unverifiable” is a verdict in its own right. Melting it into “true” or “fake” manufactures false certainty.