Caught Red-Handed: Vulnerability Scanner Lies About Being Googlebot

---

title: "Caught Red-Handed: Vulnerability Scanner Lies About Being Googlebot"

slug: threat-pattern-fake-search-bot-31-6-11-14

excerpt: "Caught in the wild: 31.6.11.14 (XSPEEDIENT, LLC) - 31 abuse reports from 25 organizations. Real OSINT, real receipts."

category: threat-intelligence

tags: [OSINT, ThreatIntel, fake-search-bot, NL, impersonation]

author: Patrick Duggan

date: 2025-11-02

featured: true

---

# Caught Red-Handed: Vulnerability Scanner Lies About Being Googlebot

**TL;DR:** 31.6.11.14 from XSPEEDIENT, LLC (NL) has been reported **31 times by 25 distinct organizations**. Pattern detected: fake-search-bot. Confidence: 95%.

The Receipts

**IP Address:** 31.6.11.14

**ISP:** XSPEEDIENT, LLC

**Country:** NL

**Usage Type:** Fixed Line ISP

**Abuse Score:** 100/100

**Total Reports:** 31

**Distinct Reporters:** 25

**Last Seen:** 2025-10-30T06:50:02+00:00

Attack Pattern

**Classification:** FAKE-SEARCH-BOT

**Severity:** MEDIUM

**Attack Types:** Web Scanning, WordPress Scanning

Why This Matters

Legitimate search engine crawlers:

- Come from verified IP ranges (Google ASN 15169, etc.)

- Respect robots.txt

- Have predictable access patterns

Fake crawlers:

- Lie about their identity (claim to be Googlebot)

- Come from random hosting providers

- Target vulnerability endpoints (wp-admin, .env files)

Evidence Sample

Here are the first 5 abuse reports (out of 31 total):

Report 1 - 2025-10-30

**Reported by:** Switzerland (CH)

**Details:**

Report 2 - 2025-10-30

**Reported by:** Sweden (SE)

**Details:**

Report 3 - 2025-10-29

**Reported by:** Switzerland (CH)

**Details:**

Report 4 - 2025-10-29

**Reported by:** Canada (CA)

**Details:**

Report 5 - 2025-10-29

**Reported by:** Netherlands (NL)

**Details:**

Detection Methodology

**Pattern:** fake-search-bot

**Confidence Score:** 95%

**Detection Factors:**

- ✅ Claims to be legitimate search crawler

- ✅ ISP: XSPEEDIENT, LLC (NOT Google/Yahoo/Bing)

- ✅ Targets WordPress admin endpoints

- ✅ High confidence user-agent spoofing

What Defenders Should Do

Detection Rules

Mitigation

1. **Block this IP immediately:** 31.6.11.14

2. **Block ASN/range if persistent:** Check if entire range is abusive

3. **Monitor for pattern:** Look for similar fake-search-bot activity

4. **Share intel:** Report to AbuseIPDB, GreyNoise, etc.

The Philosophy: Sunlight is the Best Disinfectant

We publish this because:

1. **Hoarding threat intel is morally indefensible** - If you know about a threat, share it

2. **Public attribution forces accuracy** - Show receipts or look stupid

3. **Adversaries hate documentation** - Makes their infrastructure useless once published

Raw JSON Evidence

---

**Data Source:** AbuseIPDB + Live Traffic Analysis

**Detection Time:** 2025-11-02T22:17:36.466Z

**Methodology:** Automated pattern recognition + manual verification

🧠 Generated by Central Brain - Autonomous Threat Intelligence

💰 Cost to bad guys: $0 (we publish for free)

🎯 Cost to defenders: Intelligence without the enterprise tax

*Want to dispute this? Email [email protected] with your traffic logs. We'll publish corrections if evidence supports it.*