Meta hit us 3,606 times. Seven other crawlers were not real.

We log every AI crawler that touches seobuilder.tech, because the product measures whether AI answer engines can see your site and it would be embarrassing not to watch our own. Seven days of that log, 19 to 26 August 2026, came to 7,809 requests from 20 distinct agents.

The site is three weeks old and pre-launch. Almost nobody reads it. The crawlers do not care.

Correction, 26 August: seven of these crawlers were not real

Published earlier today, corrected hours later. The table below is what our logs recorded. It is not what visited us.

One IP, 34.140.252.27, sent 375 requests in sixteen seconds while rotating through seven different AI crawler identities: Amazonbot, ChatGPT-User, ClaudeBot, OAI-SearchBot, PerplexityBot, Google-Extended and GPTBot. It resolves to googleusercontent.com, so it is a rented Google Cloud box.

It was not crawling. 213 of those 375 requests asked for /.env, /aws/metadata/iam/security-credentials, /actuator/env, /actuator/configprops and /..%252F..%252F..%252F..%252F..%252Froot/.aws/credentials. It is a credential scanner wearing AI crawler user agents to get past bot filtering. Every path returned 404 and nothing leaked.

Nine more IPs each claimed more than one company. Those asked for / and normal pages, so they look like AI-visibility testing tools rather than attacks, but an IP claiming seven companies is still not seven companies.

Counting every hit from an IP that claimed more than one company as unattributable:

547 of 7,821 requests, 7.0%, came from an IP claiming to be more than one company. Re-measured on 26 August, so the totals differ slightly from the original table because the log kept growing while this was written.

Meta, the one crawler we said nobody could verify, is the cleanest thing in the dataset. Every one of its 3,606 requests came from IPs that only ever claimed to be Meta. Meanwhile seven of the smaller crawlers we published had no legitimate traffic at all.

The mistake was ours and it was avoidable. We spent the section below explaining that spoofing cannot be measured without published IP ranges, while the evidence sat in the same table: a crawler asking for /.env is not a crawler, and noticing that needs no IP range list at all. We checked the addresses and never read the requests.

We are leaving the original numbers up rather than quietly swapping them, because a corrected table with no correction beside it teaches nobody anything.

The table

Meta alone is 46% of everything. Its three closest AI rivals, OpenAI, Anthropic and Perplexity, add up to 594 requests between them, which Meta beats six times over on its own.

Read that against the correction above before quoting it. Attributable OpenAI is 181 requests rather than 383, attributable Anthropic is 103 rather than 156, and attributable Perplexity is 7 rather than 55. Meta's 3,606 does not move, so the gap is wider than this table says, not narrower.

The paths column is the interesting one

Requests tell you who showed up. Requests divided by distinct paths tells you what they were doing.

Meta made 3,606 requests across 118 paths. That is 30 visits to each page in a week, to a site that publishes a few times a month. It found a subset of the site and then read it over and over.

Amazonbot made 405 requests across 393 paths. Almost exactly one visit per page, which read as walking the whole site and taking one copy of each. The correction above spoils it: 148 of those requests were the credential scanner, whose 213 unique junk paths are most of what made the path count look like a thorough crawl. Attributable Amazonbot is 265 requests, and we no longer claim to know its shape.

Claude-SearchBot is the cleanest version of that: 102 requests, 102 paths, all of them on 22 August. One sweep, one page each, then nothing before or since.

Those are three different strategies and you cannot tell them apart from a request count, which is the number everybody publishes.

Then we tried to check whether any of it was real

A user agent string is a claim, not an identity. Anyone can send meta-externalagent in a header. Some companies publish the IP ranges their crawlers use so you can check the claim against the connection.

Since 24 August we have checked every hit against those published ranges. Over that window, 354 requests got a verdict:

Only three companies made the check possible at all. Google, OpenAI and Perplexity publish machine readable IP ranges: Google's list, OpenAI's, and Perplexity's. Amazon, Microsoft, Apple, Anthropic, DeepSeek and Meta did not give us a list to check, so their requests return unknown no matter how carefully anyone looks.

Meta is 46% of our crawler traffic and it is in that second group. The single largest reader of this website cannot be verified by us, by you, or by anyone running a server.

About that 6.7%

Ten of the checkable requests came from outside the range they claimed. Three said Google, five said OpenAI, two said Perplexity.

Ten out of 150 is 6.7%, and that number deserves more caveats than it deserves attention. It is also the weaker of the two spoofing measurements in this post: the correction above finds 7.0% by reading what the requests asked for, needs no published IP range, and covers all 7,821 requests rather than 150. It is two days of data from one small site. The sample is 150 requests. A different week could easily produce 2% or 15%.

What it is good for is a floor on the honest version of the question. Every published claim we have seen about AI crawler spoofing rests on user agent strings, which cannot detect spoofing at all, because the spoof is the string. If you want to say what fraction of crawler traffic is fake, you first have to say how many requests you could check. For us it was 150 out of 7,809, which is 1.9%.

We are not going to publish a spoofing rate off that. Neither should anyone else.

No xAI, no Grok

Zero requests. Not one, across seven days and 20 agents.

Grok answers questions about websites, so it has the content somehow. Either it buys an index, uses Common Crawl, or crawls in a way that did not touch us in this window. We do not know which, and we would rather say that than pick the explanation that sounds most confident.

If you run a larger site and have seen xAI in your own logs, we would genuinely like to hear about it.

What we would do with this if it were your site

Check your own logs before you act on ours. Seven days from one small pre-launch site is a single data point, and the crawler that dominates our traffic may be irrelevant to yours.

If Meta shows up on your logs the way it does on ours, that is a real decision to make and almost nobody is making it deliberately. meta-externalagent bundles training with indexing for Meta AI, so blocking it to protect your writing also removes you from anything Meta's assistant answers.

And whatever you decide, decide it from your logs rather than from a blog post. Ours included.