Most of the AI Bots Hitting Your Website Are Fake

If you have been watching your website analytics lately for signs that AI is sending you customers, here is a finding worth pausing on. In an analysis published on 25 June 2026 by Search Engine Journal, the GenAI search strategist Duane Forrester, who built Bing Webmaster Tools and helped launch the structured-data standard Schema.org, looked at the traffic hitting a brand-new site of his and checked which visitors were really who they claimed to be. The results are a useful reality check for any small business now leaning on its dashboard to measure AI.

Of 33 requests that arrived wearing the name of an AI assistant (ChatGPT, Claude or Perplexity), only six were the genuine article once he confirmed where they actually came from. That is an 81.8 per cent fake rate. The other 27 were impostors, and many of them were not browsing at all: they were quietly probing the site for exposed configuration and secrets files, the kind that can leak passwords and keys. The number for Google was, if anything, worse. Of 799 requests claiming to be Googlebot, only 107 were really Google.

Forrester is one technical operator looking at one site, so treat the exact percentages as an illustration rather than a law of nature. But the underlying point is not in dispute, and it changes how you should read every AI and crawler number in your reports.

The name a bot gives you is just a label

When any visitor, human or machine, arrives at your website, it announces itself with a short line of text called a user agent: a name like Googlebot, or ChatGPT-User, or a particular browser. The catch is that this name is self-reported. Nothing forces it to be true. Anyone can put anything they like in that field, and impersonating the world's most trusted crawlers is a favourite trick for scrapers and attackers who want to slip past the welcome mat your site rolls out for the real ones. Google itself publishes a way to verify Googlebot precisely because the name alone proves nothing.

The name is self-reported, merely a string in the request header, and anyone can put anything they like there.Duane Forrester

So the bare counts your analytics tool shows you, the ones that say a particular AI crawler visited a few hundred times this month, are counting the costume, not the visitor underneath it. Confirming which of those visits were genuine takes a separate check against what each provider actually controls. That work is quiet and unglamorous, and it is the difference between a number you can trust and a number that just feels good.

Why this matters for your AI visibility

More and more Australian owners are, rightly, paying attention to whether AI assistants can find and recommend their business. We have written before about getting found by AI agents and about how AI search now sends fewer but better-qualified visitors. The risk in this week's finding is that the very thing you use to check your progress, your analytics, can quietly mislead you. A spike of ChatGPT or Perplexity visits looks like proof the strategy is working. If most of those visits are imposters, you are celebrating a mirage, and you might pour budget into the wrong place because of it.

Real AI search visibility is not whether bots wearing AI names show up in your logs. It is whether the genuine assistants can read your site, understand who you are, and put you forward when a real person asks them for a business like yours. That is a different question, and it needs a different kind of measurement than a raw traffic count.

The other half of the story is your front door

There is a security tail to this that owners should not skim past. A large share of those fake visitors were not idly window-shopping. They were rattling the handles, looking for configuration files, admin paths and credentials left exposed by accident. A small business site is just as interesting to an automated scanner as a big one, because the scanner does not care how big you are, only whether a door was left open. Reading your traffic properly is partly about measuring AI visibility, and partly about noticing when something unfriendly is testing your defences.

What good looks like

Handled properly, this turns from a worry into a quiet advantage. Here is what good looks like once your AI traffic is measured honestly rather than taken at face value:

• The AI and crawler numbers in your reports reflect verified, genuine visits, not whatever name a bot decided to wear that day.
• You can tell the difference between real interest from AI assistants and noise, so the picture you act on is the true one.
• Your visibility is judged on whether the genuine assistants actually understand and recommend you, not on a vanity count of log entries.
• Impersonators probing for exposed files and weak spots are spotted and shut out, rather than quietly mapping your site.
• When you decide where to spend next, the decision rests on real signal, so the money goes where it actually moves the needle.

If you want a simple starting point, our AI Visibility Checker gives you a first read on how the AI assistants see your business, which is a far more honest signal than a traffic count that anyone can spoof. From there, the real value is in measuring it properly over time and acting on what is genuinely working.

Telling real AI traction from noise, and keeping the impostors out of your site while you do it, is exactly the work we do as part of the AI search and SEO we run at NextAura. If you would rather act on numbers you can trust than a dashboard that flatters you, get in touch and we will verify what is real, fix what is exposed, and steer your visibility in the right direction while you get back to the business.