The Landlord: Half the Impersonation on This Estate Is Rented From the Company Being Impersonated

Letter B found a fleet wearing fifty-six identities in five seconds. Letter D found it had learned those identities by reading our blocklist one status code at a time. Letter E found that our own corpus had counted eighty-five hosts that never existed, and had to be purged before anything else could be trusted.

The corpus is clean now. The routability guard sits at ingest, so the census counts only things that could have happened. This letter is what the census says once you can believe it.

It says that impersonation is not a fringe activity here. Across the last fourteen days, 30.5% of all classified crawler traffic carried an identity its sender was not entitled to. And when you ask which identities get stolen and where the thieves rent their machines, you get an answer with an uncomfortable symmetry in it:

More than half of all the impersonation on this estate originates from Google Cloud — including the fleet impersonating Googlebot.

The shape of the thing

A price list for stolen names

Every crawler identity in the corpus can be sorted by how often it is worn versus how often it is genuinely owned. The result is not a popularity ranking. It is closer to a price list.

Googlebot is the only identity in the corpus where the impostors outnumber the original, and they do it by a factor of seven. Bingbot — functionally the same job, a major search engine's indexer, equally well documented — is impersonated once for every eighty-eight genuine addresses.

The two crawlers are not different in kind. They are different in what a webmaster does when they see the name. Googlebot is the identity most likely to be let through a rule that would stop anything else, because blocking Google is the one mistake most operators are actively afraid of making. That is precisely what makes the name worth wearing.

A crawler name's impersonation rate is not a measure of its popularity. It is a measure of its permission value — how much access the name buys from the average filter. Letter D showed a fleet discovering that value empirically, one 403 at a time. This table is the market that discovery feeds.

Names nobody real has ever worn

Five identities appear in the corpus with a spoofed count and a verified count of exactly zero:

Every single observation of these names on this estate has been someone wearing them. Not one has ever been the genuine article.

Applebot-Extended is the one Letter B was written about — Apple's opt-out signal for AI training, a name that exists mainly in robots.txt documentation. It is a good costume precisely because almost nobody has ever seen the real one, which means almost nobody has a rule that knows what the real one looks like. An identity with no genuine traffic against it has no baseline to violate.

This is the same asymmetry from the other end. Googlebot is worth stealing because everyone recognises it. Applebot-Extended is worth stealing because nobody does.

Where the costumes are rented

Sorting the 116 fake Googlebots by the network they came from is where the letter turns.

Seventy-three of the machines pretending to be Google's crawler were rented from Google.

And it is not confined to that one identity. Taking every spoofing address in the corpus and asking where it lives:

Over half of every impersonating address this estate has ever recorded sits on Google Cloud Platform. The Letter B fleet was there. The Letter D adaptation happened there. Every one of the forty Applebot-Extended costumes was rented there.

Two autonomous systems, one company name

Here is the mechanism that makes it work, and it is a single line of a WHOIS record.

Both say Google LLC. They are not the same thing at all.

AS15169 is Google's own network — where Googlebot actually crawls from, the 66.249.x space published in Google's own verification feeds. In the entire corpus it has hosted zero impersonators. You cannot rent an address there. That is the whole point of it.

AS396982 is Google Cloud Platform: customer egress. Anyone with a credit card can have an address in it in about ninety seconds, and the organisation field on that address will read Google LLC, because Google is the landlord.

So a verification that asks "is this address registered to Google?" returns yes for both the real Googlebot and the fleet impersonating it. A verification that asks "is this address inside AS15169, or inside Google's published crawler ranges?" separates them completely. The difference between those two questions is the difference between a working control and a decorative one — and the string in the org field is identical either way.

The real Googlebot addresses in this corpus are 66.249.75.35, 66.249.75.36, 66.249.64.45, 66.249.75.37, 66.249.64.44 and a dozen more like them, all AS15169. The fakes are 34.179.203.150, 34.162.15.153, 34.150.187.226, 34.17.89.110, 34.118.27.145 — all AS396982, all 34.x, all rented.

In fairness to the landlord

It would be easy and wrong to write the previous section as an indictment of Google Cloud, so here is the number that prevents it.

93.4% of the Google Cloud addresses this estate has seen have never impersonated anything. It is not a hostile network. It is a large, cheap, instantly-available one, and that is a different property with different remedies.

Letter D already tested the obvious response and rejected it. Blocking AS396982 outright would stop this entire class of impersonation and would also break a very large amount of ordinary traffic, because the same range carries thousands of addresses doing nothing wrong. The correct target was never the network. It is the claim — and the claim is refutable for free, because Google publishes exactly which addresses are allowed to say Googlebot.

The second costume shop, and the ones with no shop at all

Google Cloud is the largest venue but not the only one, and the runner-up is worth naming because it fails differently.

Nineteen of the fake Googlebots came from AS13335, Cloudflare. Cloudflare is not a VM rental business in the way Google Cloud is; it is a reverse proxy, which means an address in that range is frequently someone else's traffic wearing Cloudflare's return address. An impersonator behind Cloudflare gets two layers of borrowed legitimacy: a crawler's name in the header and a well-regarded network in the source address. Neither is theirs.

The remaining fake Googlebots are scattered thinly across ordinary hosting — LogicWeb (3), FDCservers (2), ColoCrossing/HostPapa (2). That long tail is the shape you would expect from commodity VPS abuse: a handful of machines each, no concentration, nothing to block usefully.

The concentration is the finding. Two networks account for 92 of 116 fake Googlebots; everything else is noise. When impersonation clusters that hard, the clustering itself is the detection signal — not because those networks are bad, but because a crawler that genuinely belongs to a company does not need to rent anything.

The tier nobody can adjudicate

The confidence split has a category that deserves more attention than it usually gets:

verified and spoofed are the same test with opposite outcomes. Both are cheap, both are decisive, and together they cover 75% of classified traffic. That is only possible because Google, Microsoft, OpenAI, Meta and Yandex all publish their crawler ranges.

The other 25% is the interesting part. CensysInspect shows 9 spoofed against 34 claimed; Baiduspider shows 7 against 29. For these there is no authoritative list, so an operator has three options — trust the name, block the name, or judge on behaviour — and only the third is honest. The claimed tier is where identity has to be inferred from what the traffic does rather than what it says, which is slower and weaker than a range lookup and is the reason publishing crawler ranges is a genuine public good rather than a courtesy.

Worth noting which way the incentives run: an operator who publishes their ranges makes their crawler harder to impersonate and easier to allow. Every vendor in the verified tier has effectively donated a free authentication mechanism to everyone they crawl.

What the vendors look like from here

Ranking the fourteen-day window by vendor produces a table that has to be read with the spoofing rate in mind:

Google is eleventh. The company whose crawler identity is the single most-stolen name on this estate is, by genuine verified traffic, a minor visitor — 748 hits against Meta's 8,334.

That gap is the entire thesis of this letter in two numbers. The value of the Googlebot name here has almost nothing to do with how much Google actually crawls us. It has to do with what the name is worth at the door.

Apple is the mirror image: 5,380 hits from only 51 addresses, the densest per-address traffic of any vendor — and the identity most associated with Apple in this corpus, Applebot-Extended, has never once been genuine.

The fakes work harder than the originals

One more asymmetry, and it is the one that determines how much this actually costs.

The impersonators outnumber the real crawler seven to one, and each one works twice as hard, so the fake Googlebot traffic on this estate is thirteen times the volume of the real thing.

The same pattern holds across the whole corpus. There are 4,175 verified addresses and only 385 spoofing ones — spoofers are 8% of identified addresses — yet they account for 12,428 of 40,755 classified hits. A spoofing address generates roughly seven times the traffic of a legitimate one.

That is what you would expect if the two populations were doing different jobs. A real crawler is polite: it has a budget, it honours robots.txt, it comes back tomorrow. Something wearing a crawler's name to get past a filter has no reason to be polite, because the identity is disposable and the objective is throughput.

What the census counts when it is honest

For completeness, the fourteen-day picture by stated purpose — what these agents say they are here to do:

Training is the largest single purpose by a factor of three over indexing, which is the finding Letter C documented from the other direction. Note that these are stated purposes, inherited from the identity claimed — and 30.5% of those claims are false. The purpose column is only as good as the identity column, which is the recurring lesson of this series.

Steelmanning the boring explanation

Is the classifier simply wrong about these 116 addresses? This is the first question Letter E earned the right to ask, and it was checked before anything else. Verification for Googlebot runs against Google's own published crawler ranges, re-pulled from the operator's feeds rather than hardcoded. The verified addresses land in 66.249.x / AS15169, exactly where Google documents its crawler. The spoofed ones land in 34.x / AS396982, which Google documents as customer cloud. The two populations do not overlap by a single address. If the classifier were broken you would expect noise across the boundary; there is none.

Could the 34.x machines be Google running crawlers on its own cloud? Possible in principle, and it would be an odd thing for Google to do given that they publish the ranges precisely so operators can filter on them. It is also testable and fails: Google's published feeds do not include AS396982, and a crawler that Google intended you to trust would be inside the list Google tells you to trust. An operator following Google's own published instructions would classify these exactly as this corpus does.

Is Googlebot over-represented because we happen to be interesting to Google? No — the opposite. The real Googlebot is a small presence here: 17 addresses, 333 requests, 19.6 requests each. The fake population is large. If our site were unusually attractive to Google, the verified count would be high, not the spoofed one.

Is 385 spoofing addresses too small a sample to draw a market from? It is small in addresses and large in traffic — 12,428 hits. The per-identity ratios for the low-count names (Twitterbot at 5, Feedfetcher at 4) should be read as indicative only. The headline claims rest on the large cells: Googlebot 116 vs 17, AS396982 199 of 385, and the 30.5% traffic share.

What to take from it

A name's impersonation rate measures its permission value. Googlebot is stolen seven times more often than it is used because it is the name that opens the most doors. If you want to know which identity in your allowlist is doing the most work, look at which one strangers are wearing.

An organisation name is not an identity. AS15169 and AS396982 both belong to Google LLC and mean entirely different things — one is a company's network, the other is that company's rental business. Any verification that matches on the org string passes the impersonator and the original alike. Match on the ASN, or better, on the operator's published ranges.

The cloud is the costume shop, not the villain. Half of all impersonation here rents from Google Cloud, and 93.4% of Google Cloud addresses here have never impersonated anything. Those two facts are both true and the remedy has to respect both, which rules out blocking the range and leaves refuting the claim.

Verify what is cheap to verify. Google, Microsoft, OpenAI, Meta and Yandex all publish the addresses their crawlers use, specifically so this check is possible. Every impersonation in this letter was detectable for the cost of one range lookup. The identities that cannot be checked this way — the claimed tier, 4,485 hits — are the ones worth being genuinely uncertain about.

Confidence: HIGH — that 30.5% of classified agent traffic in the window carried a spoofed identity, and that 199 of 385 spoofing addresses are on AS396982. Direct measurement over the request and IP corpus after the TI-2026-102E purge, with the routability guard active at ingest.

Confidence: HIGH — that the Googlebot classification is sound. Verified and spoofed populations separate cleanly by ASN with zero overlap, and the verified set sits inside Google's own published crawler ranges.

Confidence: MODERATE — on the interpretation that permission value drives identity selection. The Googlebot-versus-Bingbot ratio (7:1 against 1:88) is a strong and consistent signal, and Letter D provides a documented mechanism for how a fleet learns which names pass, but the intent behind the choice is inferred from behaviour rather than observed.

Verification. Reproduce with /api/web-threats/agents/breakdown?hours=336 for the confidence split, and against ip_intel by grouping on agent_product and agent_confidence. The ASN separation is SELECT asn, count(*) FROM ip_intel WHERE agent_product='Googlebot' GROUP BY agent_confidence, asn. Google's published crawler ranges are the authority for the verified set; AS15169 and AS396982 must be compared as numbers, never as organisation strings.