The Unmasking · 2 — The Impostor Economy: The Mask That Convicts the Wearer

The Unmasking — Case 2. This register takes what a visitor claims to be — the identity written in its User-Agent — and reads it for the one thing the claim cannot survive on its own word: whether it is true. Closing each case on a confidence verdict the evidence can bear: VERIFIED · CLAIMED · SPOOFED · UNVERIFIABLE.

The opening case read the visitor whose claim was truest — the training crawler, verified beyond doubt, blameless in conduct, and consequential all the same. This case turns to its exact opposite: the visitor whose claim is false, who writes a crawler's name in a header that has no right to it, and arrives not to ingest but to probe. And it opens on a finding that runs against the intuition the first case might have planted. One would expect the liar to be the harder read — the honest crawler hands you its provenance, after all, while the impostor is hiding. The opposite is true. The impostor is the easiest visitor in the entire register to convict, and he is easy for the single reason that he lied about something checkable. By choosing to name himself Googlebot, he named the one identity whose provenance is published to the world, and so he handed the register the exact yardstick against which his claim falls apart. The honest crawler's verifiable name earned it a verdict of VERIFIED and no leverage against it. The impostor's verifiable name earns him a verdict of SPOOFED and a ban within the hour. The mask he wore to get in is the handle by which he is caught — and this case reads how, and why the mask was worth wearing at all.

The visitor is a scanner. Its User-Agent reads Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) — the real Googlebot string, copied exactly. Its single request was for /administrator/components/com_jce/config.xml, the configuration file of a known-vulnerable Joomla extension, sent to a hostname it guessed rather than one that exists. It is not Googlebot. It is a probe wearing Googlebot's face, and the register's whole business in this case is to say so with proof, to explain why a probe would bother with the disguise, and to draw the structural lesson the disguise reveals: that the verification which was powerless against the honest taker of Case 1 is decisive against the liar of Case 2.

1. The Spoof Is a Failed Check, Not a Suspicion

Begin with precision about the verdict, because SPOOFED is the strongest word the register can say and it must be earned exactly. SPOOFED does not mean the User-Agent looks fake. It does not mean this seems like a scanner. It does not mean the register formed a suspicion from the shape of the traffic. SPOOFED means one specific thing and only that thing: a verifier was run, and it failed. The claimed identity implied a provenance — a published set of address ranges the real operator crawls from — the register checked the visitor's actual origin against that provenance, and the origin fell outside it. The claim was not merely unconfirmed; it was contradicted, by the same decidable test that confirms the genuine article. Where VERIFIED is the test returning inside, SPOOFED is the identical test returning outside, and the two verdicts are the two faces of one measurement.

This is what separates SPOOFED from CLAIMED, and the separation is the whole reason the register can convict here rather than merely decline. CLAIMED is the verdict for a visitor whose identity cannot be checked — an operator who publishes no ranges, a name with no provenance to test against; there the register believes the claim on its face because it has no instrument to do otherwise, and flags it honestly as unconfirmed. SPOOFED is categorically different: it is not the absence of a check but the failure of one. The register did not run out of instrument; it applied the instrument and the claim broke. So SPOOFED is the register's one prosecutorial verdict, the only place in the whole method where the evidence does not just fall short of proving an identity but affirmatively disproves it — and it can reach that verdict precisely because the impostor chose a checkable name. Had he claimed nothing, the register would have had nothing to falsify. He claimed Googlebot, and Googlebot is falsifiable, and so he is falsified. The lie is convictable in exact proportion to how checkable it is, and the impostor picked the most checkable lie on the internet.

2. Why Wear the Mask — The Economy of Borrowed Trust

The obvious question is why a scanner bothers. Faking a User-Agent costs nothing and hides nothing about the visitor's conduct — the probe is still a probe, the exploit path still an exploit path. So what does the disguise buy? It buys trust the impostor did not earn, borrowed from the crawler whose name he wears, and the borrowing is the entire logic of the impostor economy.

The real search crawlers are, across the web, privileged traffic. Sites that would challenge, rate-limit, or block an unknown client wave Googlebot through — serve it more freely, exempt it from the bot-walls and CAPTCHAs and JavaScript challenges that gate ordinary visitors, because being indexed is worth having and turning the indexer away is self-harm. Two decades of Googlebot behaving well (the good conduct Case 1 documented in its own subject) built a name that opens doors, and the whole point of the name opening doors is that operators trust it. That trust is a standing asset attached to the string Googlebot/2.1 — and an asset attached to a string is an asset that can be stolen by copying the string. The impostor pastes the name into his header not to change what he does but to change how he is received: to be handled as the privileged crawler rather than the suspicious scanner, to inherit the allowlist Googlebot earned, to slip past the defenses that trust the name he is wearing. This is the economy in one line: the mask is worn for the trust the real crawler's verification earned it. The impostor is a free-rider on Case 1's honesty — and the more the honest crawler is trusted, the more the mask is worth. That is why the impersonated names are always the verified ones; nobody spoofs a nobody. The value of the disguise is exactly the value of the reputation it steals.

And this reframes what the verification layer is for. In Case 1, verifying the honest crawler gained the register knowledge and no leverage — the honest taker broke no rule and could not be stopped. Here the same verification does the work that matters: it is the mechanism that strips the stolen trust back off the string. The allowlist the impostor is trying to inherit is only safe to grant if "claims Googlebot" can be separated from "is Googlebot" — and separating them is precisely what the verifier does. Verification is not, at bottom, a tool for characterising honest crawlers; it is a tool for defending the value of an honest crawler's name against the thieves who copy it. The register reads the impostor as the reason verification exists.

3. On Google's ASN Is Not Googlebot

Now the archetype, and the technical heart of the case, because the impostor here is cleverer than a bare liar and the extra cleverness is exactly what a naive check would fall for. The scanner claiming Googlebot did not arrive from a random hosting company. It arrived from 35.247.135.112, an address whose network registration reads Google LLC, operated by Google Cloud, on AS396982 — GOOGLE-CLOUD-PLATFORM. Every coarse signal says Google: the org is Google, the operator is Google, the Autonomous System is Google's. A verifier that asked the simple question — is this IP on a Google network? — would answer yes, and wave the probe through as the genuine crawler. The impostor rented a virtual machine inside Google's own cloud specifically so that the lazy question returns yes.

The register does not ask the lazy question, and the distinction it draws instead is the one the whole taxonomy is built on. Google's crawler and Google's cloud are not the same network, even though both belong to Google. Googlebot crawls from a specific, published set of ranges that Google documents precisely so the world can verify them — and forward-confirmed reverse DNS on the real crawler resolves into googlebot.com, a namespace Google controls and rented VMs cannot enter. Google Cloud Platform, by contrast, is rentable compute: anyone with a credit card can boot a machine on AS396982, and that machine sits on a Google-owned network while having nothing whatever to do with Google's crawler. So the correct test is not is this IP Google's? but is this IP inside Google's published crawler ranges? — and 35.247.135.112, a GCP tenant address, is not. It is Google's cloud and not Google's crawler, and the gap between those two facts is the gap the impostor was hiding in. This is why the register verifies the search crawlers against their published crawler CIDRs and never against their parent ASN: the ASN is shared between the crawler and the rentable compute, so an ASN-level check would launder every GCP-hosted scanner into a verified Googlebot. The CIDR check refuses the laundering. It asks the one question the impostor cannot pass — did you crawl from where Googlebot crawls? — and the answer, provably, is no. The disguise that beats the coarse check is defeated by the precise one, and the precision is not incidental; it is the specific design decision that makes the whole verdict trustworthy.

4. The Mask Is Also the Trigger

The impostor's lie does a second kind of work, and it works against him. Having established that the visitor is not Googlebot, the register looks at what it did, and the conduct convicts as plainly as the provenance. The single request was GET /administrator/components/com_jce/config.xml — the config file of the Joomla Content Editor extension, a component with a long history of exploited vulnerabilities, requested by path with no preamble, the signature of a scanner testing for a known weakness rather than a crawler following a link. And it was sent to a hostname the visitor guessed — a vhost that does not exist on the infrastructure, returning 404, the visitor spraying a plausible-sounding subdomain in the hope something answered. A crawler indexes links it was given; this visitor probed a path it was fishing for, on a host it invented. The behaviour is a scan, and the AbuseIPDB reputation attached to the address (score 28, reported by others) corroborates that this is not the address's first such outing.

Here the disguise closes the trap it opened. The register's automated response weighs a visitor's malicious evidence against a threshold, and for most probe intents that threshold requires volume — a single guessed vhost is ordinarily too thin to ban on, the kind of stray 404 that could be noise. But a confirmed impostor is treated differently, and deliberately so: once the identity verdict is SPOOFED, the benefit of the doubt is withdrawn, and the threshold for the very intents an impostor uses to hunt drops to one. A visitor caught lying about who it is has forfeited the presumption of innocence that a merely-anonymous scanner would still hold; its single guessed-vhost probe, which would have been below the line for an unlabelled client, is over the line for a proven fraud — because the lie is itself evidence of intent. So this scanner was banned on the strength of one request: a CrowdSec decision written with the scenario web-threats/autoban (spoofed impostor): vhost_enum:1, pushed to the MikroTik edge as a firewall drop on 35.247.135.112/32, enforced within the hour. The mask lowered the bar it had to clear. The impostor wore Googlebot's name to be trusted more, and the wearing is exactly what got him trusted less — convicted by the provenance his name invited the register to check, and banned faster because the checked name came back false. His dishonesty was not a shield; it was the trigger.

5. From One Impostor to a Fleet

A single fraud on a rented VM would be a curiosity. The register reads the archetype as a specimen of a population, because the evidence shows the specimen is not alone — the impostor is a category with volume, coordination, and a business model.

The volume first: across the reading week the register recorded 423 spoofed verdicts — 423 visitors that claimed a checkable identity and failed the check, a steady background of stolen names, not one anomalous host. And the archetype's exact pattern recurs: a second fake Googlebot, 34.21.136.47, arriving from the same Google Cloud network (AS396982), the same copied string, the same single guessed probe returning 404 — GCP is the impostor's preferred address precisely because it is the mask and the host in one, a Google-owned IP to launder a Google-named lie. And the coordination: the register also holds a fleet form of the same tactic — a vhost-sweep campaign out of AS14618 (Amazon's cloud), sixteen distinct IPs each enumerating five or more guessed subdomains, 342 requests in concert, an effective-bad-rate of 0.91 marking almost the entire campaign as hostile. Where the archetype is one impostor guessing one host, the campaign is sixteen coordinated machines guessing many — the industrialised version of the same fraud, rented by the rack from a mainstream cloud, spraying invented hostnames behind whatever name buys the least friction. The impersonation is not a quirk of one misconfigured tool. It is a method, deployed at retail by lone VMs and at wholesale by rented fleets, and the 423 are its weekly footprint on a single small infrastructure.

The register also notes what makes the verdict robust across the whole population: the verifier is vendor-agnostic. It caught a fake Googlebot the same way it catches a fake Bingbot — a visitor wearing Microsoft's crawler string from a network outside Microsoft's published ranges returns SPOOFED by the identical logic, the name checked against the provenance the name implies, wherever the name points. The impostor economy is not a Google problem or a Bing problem; it is the general problem of valuable names being copyable, and the verifier is the general answer — check every claim against the provenance it invokes, and let each stolen name convict its wearer.

6. Powerless Against the Honest, Lethal Against the Liar

The register now draws the structural lesson, because Cases 1 and 2 are built to be read together and the pair says something neither says alone. The same verification behaves oppositely against the honest visitor and the dishonest one, and the opposition is the point.

Against the honest taker of Case 1, verification produced knowledge and no leverage. GPTBot verified as genuinely itself, and the verdict changed nothing about its ability to keep taking, because it broke no rule and a true identity is no grounds for a block. Verification, there, was a pair of open eyes with no hands — it could see the taker perfectly and could not touch it. Against the dishonest visitor of Case 2, the identical test is lethal. The fake Googlebot's claim was checked by the same instrument, against the same kind of published provenance, and the check came back false — and the false check is directly actionable, because a visitor lying about a privileged identity has both disqualified itself from the privilege and supplied, in the lie, the evidence of ill intent that licenses a ban. The eyes that could not touch the honest taker close around the liar's throat. One measurement, two opposite consequences, and the difference between them is nothing but the truth of the claim: verification cannot constrain a visitor whose identity is real and whose conduct is permitted, and it can destroy a visitor whose identity is stolen and whose conduct is a probe.

This resolves the unease Case 1 ended on. There, verification looked almost futile — enormous certainty about who was taking, no power to affect it, open eyes and no hands. Case 2 shows the eyes were never the whole apparatus. The value of verifying honest crawlers is not the leverage it gives against them; it is the leverage it gives against everyone who copies their names — because a name is only worth stealing if it is trusted, and it is only safe to trust if the theft can be detected, and detecting the theft is exactly what verifying the honest crawler makes possible. The two cases are one mechanism seen from both sides: the verification that reads Case 1's honest crawler as VERIFIED is the same verification that reads Case 2's impostor as SPOOFED, and the second reading is where the mechanism earns its keep. You verify the honest to defend them from the dishonest. The mask the impostor wears to borrow the crawler's trust is the precise seam along which the register tears the trust back off — and the tearing is only possible because the crawler was verifiable in the first place.

7. The counter-narrative, steelmanned

The strongest objection to this case is that it makes a drama out of a triviality. A spoofed User-Agent, the objection runs, is the cheapest and most meaningless act on the internet: the header is free text, everyone knows it is free text, faking it proves nothing and defends against nothing, and any competent operator treats the User-Agent as unreliable by default and reads the traffic instead. To dress a single misconfigured or lazy scanner — one request, one 404, one copied string — in the language of an "economy" and a "fraud convicted within the hour" is to inflate a non-event; the scanner did not get in, it hit a 404 on a host that does not exist, and the elaborate machinery of provenance-checking and threshold-lowering is a cannon fired at a mosquito that was already flying into a wall. Worse, the objection continues, the register cannot even be sure of malice: a broken crawler, a QA tool left misconfigured, a researcher's script with a copy-pasted header — any of these would produce the same "spoofed Googlebot" line without a hostile hand behind it, and the register's leap from wrong User-Agent to impostor to ban is a chain of presumption dressed as proof.

The register grants the cheapness and denies that cheapness makes it trivial, and it answers the malice point with the evidence rather than around it. That the header is free text is not a weakness in the verdict — it is the premise of the verdict; the register never treats the User-Agent as reliable, which is the entire reason it checks it, and SPOOFED is not "the header was wrong" but "the header was checked against provenance and provably contradicted." The objection's own principle — treat the User-Agent as unreliable, read the traffic instead — is precisely what the register did: it read the traffic, and the traffic was an exploit-path probe against a guessed vhost from an address others have already reported for abuse. So the leap the objection alleges is not made. The register does not reason wrong User-Agent, therefore malice; it reasons the identity claim was provably false (a checked verdict, not a suspicion) and the conduct was a Joomla-exploit probe on an invented hostname (an observed act, not an inference) and the address carries an abuse reputation from third parties (external corroboration) — three independent facts that converge, no one of them load-bearing alone. The benign-tool reading has to explain away all three at once: a misconfigured QA script does not fish for com_jce/config.xml on subdomains it guessed, and a broken crawler does not accumulate an AbuseIPDB record. And the triviality charge mistakes the specimen for the claim. The register does not rest the "economy" on one host; it rests it on 423 spoofed verdicts in a week, a duplicate fake Googlebot on the same cloud, and a sixteen-IP coordinated sweep out of AWS at a 0.91 bad-rate — a population, of which 35.247.135.112 is merely the clearest single frame. That this particular probe hit a 404 is not evidence the tactic is harmless; it is evidence the guessed hostname happened not to exist, and the next guess, on the next site, may. The cannon is not fired at one mosquito. It is a standing instrument aimed at a standing swarm, and the one mosquito is shown because it is the one the register can hold up to the light in full. No individual is named — the actor behind a rented VM is not identified and is not the register's subject; the method is. Classification: TLP:WHITE. The impostor's claim was false, we proved it false, its conduct was a probe, and we let the proven fraud convict itself.

8. Identity Signal — SPOOFED

Case 2 read the visitor whose claim is false, and found — against intuition — the easiest conviction in the register, for the exact reason the claim was checkable. The frame carried from Case 1: the claim is the identity made testable, and SPOOFED is the verdict when the test is not merely unavailable (that is CLAIMED) but run and failed — the register's one prosecutorial verdict, reachable only because the impostor chose a name whose provenance is published and therefore falsifiable. He claimed the most checkable identity on the internet, and so handed the register the yardstick that breaks him.

The archetype: a scanner sending the exact Googlebot/2.1 string from 35.247.135.112 — network-registered to Google LLC, operated by Google Cloud, on AS396982 — whose coarse signals all read Google and whose precise provenance reads not Googlebot, because Google's cloud is not Google's crawler: GCP is rentable compute sharing the parent's ASN, and the real crawler is verified against its published crawler CIDRs, which a rented GCP tenant address is provably outside. This is why the taxonomy checks search crawlers against CIDRs and never against the shared ASN — an ASN check would launder every cloud-hosted scanner into a verified crawler. The conduct convicts alongside the provenance: a single GET /administrator/components/com_jce/config.xml (a Joomla-exploit probe) to a guessed, nonexistent vhost → 404, from an address carrying an AbuseIPDB score of 28. And the mask did double work against its wearer — SPOOFED withdrew the benefit of the doubt, dropping the ban threshold for the impostor's hunting-intents to one, so the single probe that would have been below the line for an anonymous scanner was over it for a proven fraud: banned via CrowdSec (web-threats/autoban (spoofed impostor): vhost_enum:1), enforced on the MikroTik edge within the hour. Why wear the mask: to steal the trust the verified crawler earned — sites privilege Googlebot, so a scanner wears the name to inherit the allowlist; the impersonated names are always the verified ones, because nobody spoofs a nobody. The population: 423 spoofed verdicts in the week, a duplicate fake Googlebot (34.21.136.47) on the same GCP network, and a sixteen-IP vhost-sweep campaign out of AS14618 (AWS) at a 0.91 effective-bad-rate — a method sold at retail and wholesale, and the verifier catches it vendor-agnostically (a fake Bingbot from outside Microsoft's ranges returns SPOOFED by identical logic). The structural lesson, read with Case 1: the same verification is powerless against the honest taker and lethal against the liar — it gave no leverage over GPTBot, whose true identity is no grounds for a block, and decisive leverage over the fake Googlebot, whose false identity is both disqualification and evidence; you verify the honest to defend their names from the dishonest who copy them, and the mask worn to borrow trust is the exact seam by which the register tears it back. No individual named — the method is the subject, not the renter of a VM. Classification: TLP:WHITE.

The Unmasking — Case 2. Identity signal: SPOOFED. Confidence: HIGH for the identity verdict (a verifier was RUN and FAILED — the claimed Googlebot provenance is Google's published crawler CIDRs, and 35.247.135.112 is a GCP tenant address on AS396982, provably outside them; SPOOFED = checked-and-contradicted, the register's one prosecutorial verdict, categorically distinct from CLAIMED = no-check-possible). DOCUMENTED for the conduct (single GET /administrator/components/com_jce/config.xml Joomla-exploit probe to a guessed nonexistent vhost → 404; AbuseIPDB 28; CrowdSec ban web-threats/autoban (spoofed impostor): vhost_enum:1; MikroTik crowdsec-blacklist 35.247.135.112/32, enforced within the hour) and the population (423 spoofed verdicts / 168h; duplicate fake Googlebot 34.21.136.47 on the same GCP AS396982; 16-IP vhost-sweep campaign on AS14618/AWS at 0.91 effective-bad-rate; fake Bingbot from outside Microsoft ranges → SPOOFED by identical logic). THE TECHNICAL HEART: Google's cloud ≠ Google's crawler — GCP is rentable compute sharing the parent ASN, so search crawlers are verified against PUBLISHED CIDRs, never the shared ASN; an ASN-level check would launder every cloud-hosted scanner into a verified crawler. The impostor rents a Google-owned IP precisely so the lazy question (is this Google's network?) returns yes; the precise question (is this inside Googlebot's crawl ranges?) returns no. THE ECONOMY: the mask is worn to STEAL the trust the verified crawler earned — sites privilege Googlebot, so a scanner copies the name to inherit the allowlist; the impersonated names are always the verified ones (nobody spoofs a nobody), so the disguise's value equals the reputation it steals. THE TRIGGER: the lie does double work against its wearer — SPOOFED withdraws the benefit of the doubt, dropping the impostor's hunting-intent threshold to 1, so a single guessed-vhost probe (below the line for an anonymous scanner) is over it for a proven fraud. THE STRUCTURAL LESSON (read with Case 1): the same verification is POWERLESS against the honest (a true identity is no grounds for a block — GPTBot) and LETHAL against the liar (a false identity is disqualification + evidence — the fake Googlebot); you verify the honest to defend their names from the dishonest who copy them. Steelmanned objection (a spoofed UA is trivial free-text noise, possibly a benign misconfigured tool, and one 404 is a non-event) is answered by conceding the header's unreliability as the PREMISE of checking it, and by three converging independent facts — provably-false provenance (checked, not suspected) + an exploit-path probe on a guessed host (observed, not inferred) + third-party abuse reputation — which the benign reading must explain away all at once; and by resting the "economy" on the 423-strong population, not the single specimen. No individual named — the method is the subject. Classification: TLP:WHITE. The impostor chose the most checkable lie on the internet; we checked it, it failed, and the mask convicted the wearer.