How do I know whether a request claiming to be GPTBot is real?

Why the string is not enough

Scrapers copy the GPTBot user agent because sites tend to allow it. A robots.txt rule or a rate limit keyed on the string therefore treats the copy the same as the original. The only reliable signal is the network address, which the vendors publish precisely so that sites can tell.

Where the ranges come from

Supported operators publish crawler or fetcher address ranges. The importer uses refreshed lists for supported identities and preserves an unavailable status where matching evidence is missing. Check the operator's current documentation for each identity.

Doing it by hand

Take the address from the log line, fetch the vendor's list, and test whether the address is inside any of the CIDR blocks. For one line that is a minute; for a night's log it is a script. The log import does it for every line and shows the result per agent as verified and unverified counts.

curl -sS -X POST https://agenttracking.co/api/logs/example.com \
  -H "Authorization: Bearer wmt_your_token" \
  -H "Content-Type: text/plain" --data-binary @/var/log/nginx/access.log

What to do with an unverified claim

The product does not block requests. Investigate log provenance and current operator ranges before making an edge rule; robots.txt is a crawler instruction, not an authentication control.

In short