Googlebot? Come Right In. Wait… Who Are You?

There was a time when seeing "Googlebot" in your server logs was enough to make most website owners roll out the red carpet.

Googlebot? Come right in.

We know the feeling. We used to do it too.

Then last weekend, something calling itself Googlebot knocked on our door — and asked for our password files.

What actually happened

On August 8, our bot monitoring lit up. A visitor identifying as GoogleOther (one of Google's official crawlers) fired 138 requests at wagerx.io in a couple of bursts.

But it wasn't asking for our casino reviews or our racing pages. It was asking for things like:

• /.env — the file where careless sites keep API keys and database passwords
• /service_account.json — Google Cloud credentials
• /.git/HEAD — the entry point to downloading a site's entire source code
• /wp-config.php.bak — leftover WordPress config backups with database logins
• /storage/logs/laravel.log — error logs that often leak secrets
• Even .claude.json and other AI-tool config files — a 2026 twist: scanners now hunt for AI agent credentials too

Google does not crawl websites looking for password files. That's not indexing. That's burglary with a name badge.

The clever part

Here's what made this one more interesting than the average impostor: it wasn't just wearing a Googlebot costume. It was operating from rented Google Cloud servers.

So at first glance, everything looked vaguely Google-ish. The User-Agent said Google. The IP address traced back to Google's infrastructure.

But Google Cloud is infrastructure anyone can rent — the same way a burglar can rent a van that says "Official Delivery" on the side. The van being real doesn't make the delivery real.

A Google IP is not Googlebot. "Googlebot" in the User-Agent is not Googlebot.

How we checked the badge

Google knows its name is the most impersonated one on the internet, so it publishes an official way to verify its crawlers — and almost nobody uses it:

1. Take the visiting IP address and do a reverse DNS lookup. Real Google crawlers resolve to hostnames ending in googlebot.com or google.com.
2. Then resolve that hostname forward again. It must point back to the exact same IP.

A rented cloud server can fake the name on the badge, but it cannot fake this two-way handshake. Our visitor resolved to googleusercontent.com — the tell-tale signature of a rented Google Cloud machine, not a Google crawler.

Case closed:

A User-Agent is a claim. An IP address is a clue. Behaviour is evidence.

And the behaviour — 138 requests hunting for credential files — was all the evidence we needed.

What it got: nothing

Every single probe came back empty. 404 after 404. WagerX doesn't keep secrets in files a web server can reach, and there's no exposed .git folder to raid.

Since then, we've gone one step further. Every visitor claiming to be Googlebot, GoogleOther, Bingbot or any other major crawler now gets its badge checked automatically at the door. Real crawlers pass through instantly. Impostors get a locked door — before a single page renders.

In the first days, our stats counted 500+ fake Googlebot requests bounced. They're still knocking. The door stays shut.

We've been dealing with this since 2018

This isn't a new problem for us. WagerX has been fighting bots, scrapers and spam attacks since 2018, back when this project operated as NewCryptoCasinos.

Over the years we learned that the interesting part isn't blocking bots. It's understanding them. Which bots visit, what they request, what infrastructure they run on — and most importantly, what they're actually trying to find.

A single strange request means nothing. The same infrastructure coming back for weeks, probing for credentials under a borrowed name? That tells a story.

The modern web isn't just humans and search engines anymore. It's AI systems, SEO crawlers, data collectors, monitoring services, scrapers — and occasionally, things that aren't honest about who they are.

What should website owners do?

You don't need enterprise security tooling to protect yourself. You need healthy suspicion and five minutes:

1. Read the claim. Check what the crawler says it is in the User-Agent.
2. Check the badge. Run the reverse-plus-forward DNS check above. Every major search engine documents its official verification method.
3. Watch the behaviour. Google asks for your pages. Scanners ask for your .env. The request list tells you who you're dealing with faster than any IP database.
4. Correlate. One odd signal is noise. Several independent signals pointing the same way is a pattern.
5. Keep records. Your server logs know far more than your analytics dashboard — analytics scripts don't even fire for most bots.

And the lesson we'd put on a poster:

Don't trust the name on the visitor's badge. Check the badge. Check the building. Check the behaviour. Then decide whether to let them in.

WagerX Tech — tracking what happens behind the scenes of the modern web. Since 2018, we've dealt with bots, crawlers, scraping and spam attacks. Today we use that experience to help website owners understand who — and what — is actually visiting their sites.