op111.net - SEO criminality

I have been looking at web server logs a lot lately, for something I’m working on. I see a lot of stupid things and a lot of strange things. Yesterday I noticed this:

85.208.98.228 - - [02/Nov/2025:13:26:41 +0000] "GET /robots.txt HTTP/1.1" 200 3792 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

Anyone who has spent an hour or two of their lives looking at logs of web servers would pause on seeing 85 at the start of that line.

That is not a subnet Google’s services use. Unless they started using it yesterday.

I selected the address and hit my hotkey.

(I have a hotkey that looks up the current selection on IPinfo. If tasks like this take long, you tend to avoid them, and then you miss opportunities to learn things, fix things, or improve things.)

ipinfo.io/85.208.98.228

SUMMARY

ASN             AS396982 - Google LLC
Hostname        101.siteaudit.bot.semrush.com
Range 	        85.208.98.0/24
Company         SEMrush CY LTD
Hosted domains  0
Privacy         True
Anycast         False
ASN type        Hosting
Abuse contact   bot@semrush.com

OOHH!

That is not good!

Maybe IPinfo’s info is out of date?

Let me check the Google ranges:

Nothing starting with 85 in the ranges Google publishes.

It must be what it looks like then:

A bot that is not Googlebot, not from some random operator (common) but from a company in the New York Stock Exchange, impersonating Googlebot.

It’s so absurd it’s incredible.

I kept looking. Did a web search for the IP address and followed a link to an FAQ section on the website:

To whitelist the bot, contact your webmaster or hosting provider and ask them to whitelist SiteAuditBot.

The bot’s IP addresses are: 85.208.98.128/25 (a subnet used by Site Audit only)

I normally cite sources but I will make an exception this time.

So I started thinking to myself:

This is important. Maybe I should write about it. People should know.

Then I remembered Demetris’ Law of New Discoveries (which I am certain has existed for decades with many other names):

Every time you think of something or discover something that you think is new, chances are it has been discussed for years on the web and the internet.

I ran a search on Google Search: SEMrush bot impersonates Googlebot

First result: GitHub - nginx-ultimate-bad-bot-blocker - Issues - SEMRUSH now hiding their SEO scanners as Fake Google Bots (2019)

Second result: John Mueller’s randoms - Bots that impersonate Googlebot (2021)

It’s been known for years.

But maybe it was just a glitch in my case? (Still incredulous.) Let me look at the log for the previous month…

Not a glitch:

85.208.98.224 - - [05/Oct/2025:13:43:40 +0000] "GET /robots.txt HTTP/1.1" 301 675 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.224 - - [05/Oct/2025:13:43:40 +0000] "GET /robots.txt HTTP/1.1" 200 4000 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.224 - - [05/Oct/2025:13:43:40 +0000] "GET /53 HTTP/1.1" 301 658 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.229 - - [12/Oct/2025:12:37:39 +0000] "GET /robots.txt HTTP/1.1" 301 675 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.229 - - [12/Oct/2025:12:37:39 +0000] "GET /robots.txt HTTP/1.1" 200 4001 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.229 - - [12/Oct/2025:12:37:39 +0000] "GET /53 HTTP/1.1" 301 658 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.226 - - [19/Oct/2025:12:14:22 +0000] "GET /robots.txt HTTP/1.1" 301 675 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.226 - - [19/Oct/2025:12:14:22 +0000] "GET /robots.txt HTTP/1.1" 200 4000 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.226 - - [19/Oct/2025:12:14:22 +0000] "GET /53 HTTP/1.1" 301 658 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.226 - - [26/Oct/2025:11:40:37 +0000] "GET /robots.txt HTTP/1.1" 301 675 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.226 - - [26/Oct/2025:11:40:37 +0000] "GET /robots.txt HTTP/1.1" 200 3794 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
85.208.98.226 - - [26/Oct/2025:11:40:38 +0000] "GET /53 HTTP/1.1" 301 658 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

I seemed to remember I had a place in my config for cases like that.

Hey, Claude. Check to see if I have any rules for Googlebot impersonators.

I did.

I added the new range there:

##  Impersonates Googlebot
RewriteCond %{HTTP_USER_AGENT}  "=Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
RewriteCond %{REMOTE_ADDR}  "^85\."     [OR]
RewriteCond %{REMOTE_ADDR}  "^95\."     [OR]
RewriteCond %{REMOTE_ADDR}  "^185\."
RewriteRule .* - [R=451,L]

Good.

The investigation took more than I’d like, but I now block even more fake Googlebots.

Great!

Now…

There are many questions one could ask after finding out that this has been going on for years. For example:

Why doesn’t Google kick them out of Google Cloud Platform?

The questions are simple but the answers are difficult and go into different territories, so I will ignore them here.

The important practical thing, if you are still reading this far down, is that today you learned two things you maybe didn’t know:

SEMrush are not people you should trust
You should block Googlebot coming from their ranges

Or, even better, block all SEMrush ranges you know of, including the SEMrush ASNs (they have their own ASNs too and they visit from those too).

If they program their bots to behave like that for a post on Demetris’ site that was written in 2008 and is of mostly historical interest these days, I can only imagine what they do for websites that have high value for their owners and for the competitors of their owners.

And of course it is our good friends the Cypriots assisting again.

— Demetris, 2025-11-04