See it on a real storeBots, pages and people sent by AI on an example store. No sign-up.Fake AI bot report, November 2026.
Every "CCBot" visit to our sites was fake. So were 87% of "PerplexityBot" visits and 32% of "GPTBot".
By bot, checkable visits only.
Fakes pick the names with the least real traffic. OAI-SearchBot, the busiest real bot, was 99% genuine.
| Claimed bot | Visits checked | Fake | Fake share |
|---|---|---|---|
| CCBot | 122 | 122 | |
| DuckAssistBot | 115 | 115 | |
| Perplexity-User | 98 | 98 | |
| PerplexityBot | 153 | 133 | |
| GPTBot | 291 | 92 | |
| ChatGPT-User | 494 | 96 | |
| Amazonbot | 2,968 | 129 | |
| OAI-SearchBot | 11,672 | 154 |
“Checkable” means the operator publishes IP ranges or a reverse DNS name, so each visit can be proven real or fake. A visit is fake when it uses the bot's name but fails every check the operator publishes.
Who sends them, scanners.
7 Google Cloud VMs sent every fake we saw. Each one rotated through up to 8 AI bot names.
The Googlebot loophole they also useOne address used GPTBot, ChatGPT-User, OAI-SearchBot, PerplexityBot, Perplexity-User, CCBot, Amazonbot and DuckAssistBot in turn. About two in three of their requests asked for files that hold secrets: .env, credentials.json, .aws/credentials, .git/config and Kubernetes tokens.
They borrow AI bot names because many sites let those through. Counting them as real inflates AI traffic numbers and hides what the real bots read.
The same scanners also used ClaudeBot, Claude-User, Meta-ExternalAgent, cohere-ai and Bytespider. Those operators publish no IP list or reverse DNS name, so their real visits can't be told from fake ones. On sensegap.com alone, 434 requests for secret files arrived under those names.
By site, all AI bot visits.
Small sites see the most fakes. Real bots barely visit them, scanners visit everyone.
| Site | AI bot visits | Proven real | Can't be checked | Fake | Fake addresses |
|---|---|---|---|---|---|
| sensegap.comSaaS, two weeks old | 3,931 | 57% | 29% | 14% | 4 |
| vitalo.roMedical tests | 4,771 | 86% | 8% | 6% | 2 |
| altziar.roNews | 122,411 | 7% | 93% | <0.1% | 1 |
| pdfsimplu.roPDF tools | 2,684 | 12% | 88% | 0% | 0 |
Method, and its limits.
Four sites, every claimed AI bot visit, checked the same way.
How we verify botsWe ran SenseGap's open-source verifier over 8 days of traffic on four of our own sites: sensegap.com, vitalo.ro, altziar.ro and pdfsimplu.ro. Each visit that claimed to be an AI bot was checked against the IP lists the operator publishes, or its reverse DNS name confirmed by a forward lookup.
The traffic comes from Cloudflare's analytics, which are sampled, so exact counts move by a few percent between runs. The shares held steady across three runs. Four small to medium sites, three of them Romanian, are a field report, not a survey of the web.
A new edition comes out every month. Data is free to use under CC BY 4.0 with a link to this page.
Cite this, free to use.
Use the numbers, link the source.
SenseGap, "Fake AI bot report, November 2026", https://sensegap.com/reports/fake-ai-bots
<a href="https://sensegap.com/reports/fake-ai-bots">SenseGap fake AI bot report</a>