Your log says Googlebot. Find out whether it really was. Free check by forward-confirmed reverse DNS, no account.
A User-Agent header is free text: any client can send “Googlebot” and most fake crawlers do. The reportedIP Bot Verification runs the method the operators themselves publish, forward-confirmed reverse DNS, and tells you whether the address behind the claim really belongs to Google, Microsoft, Apple, Yandex, Baidu, OpenAI, Perplexity or Anthropic.
Anything can send any User-Agent. Announcing yourself as Googlebot takes one line of code, and scrapers do it constantly, because plenty of sites wave search engines past their rate limits and paywalls. The string in your log is the account the visitor gives of itself.
What cannot be faked is DNS, and that is what the search engines tell you to check.
Google, Microsoft, Apple, Yandex and Baidu all describe the same method. Look up the reverse record of the address. See whether the name it returns belongs to the operator. Then resolve that name forward and check that it leads back to the same address. An impostor can fake at most one of those two directions, because the second one is published by the operator, not by the visitor.
The trap in step three is that a name often resolves to several addresses. Comparing only the first one marks correct crawlers as fakes, so the whole set is compared.
The AI crawlers took a different route. OpenAI, Anthropic, Perplexity and DuckDuckGo publish lists of the address ranges they crawl from instead of maintaining reverse records. Their addresses have no reverse record at all, so this method returns no answer for them, and the result says so rather than calling a real crawler an impostor.
Confirmed: the address belongs to the crawler it claims to be.
Not confirmed: there is no reverse record, or it does not lead back, or the User-Agent claims an operator that DNS does not support. This is the one worth acting on.
Not attributable: everything resolves correctly, but it is not a known crawler. That is not a fault, just no statement.
Three steps. The PTR record of the address is looked up. The name that comes back is compared against the operator’s own verification domains, on label boundaries, so a host called notgooglebot.com is not mistaken for googlebot.com. That name is then resolved forward, A and AAAA, and the full answer set has to contain the address the check started with.
Both halves are needed. Whoever holds an address block can write any name into its PTR record, including crawl-1.googlebot.com. What they cannot do is add that address to the forward zone of googlebot.com, which is why the forward probe is the half that decides.
Three results are kept apart. Confirmed means the name belongs to a known crawler and the forward probe agrees. Not confirmed means there is no PTR record, the forward probe failed, or the User-Agent claims a crawler that DNS does not support: this is the case to act on. Not attributable means everything resolves cleanly but the address belongs to no crawler this tool knows, which is a normal result for ordinary visitors and no defect at all.
One limit worth knowing: OpenAI, Perplexity, Anthropic and DuckDuckGo verify their crawlers through published lists of address ranges instead of reverse DNS. For those, an unconfirmed result here is not proof of a forgery, and the report says so where it applies.