Key points
- Google nameservers incorrectly validated Russian IP addresses as legitimate Googlebot traffic.
- A reverse DNS record was found directing AI agents while passing forward confirmation checks.
- An exfiltration payload bypassed standard filters for spaces, parentheses and quotes to phone home.
Security researchers identified a combination of reverse DNS manipulation and fake bot identities that could allow attackers to bypass security controls. The findings highlight vulnerabilities in how organisations verify automated traffic and handle data exfiltration attempts.
What happened
According to a report shared on the r/netsec forum by user HexLayer3, Google’s own nameservers vouched for Russian IP addresses as legitimate Googlebot traffic. This misidentification occurred despite the use of FCrDNS verification, with twenty-eight fake Googlebot instances successfully passing the forward confirmation checks.
One specific PTR address was discovered that directly addresses AI agents. This record passes forward confirmation, potentially allowing malicious actors to impersonate legitimate search engine crawlers when interacting with automated systems.
The report also detailed an exfiltration payload designed to evade standard security filters. The payload dodged restrictions on spaces, parentheses and quotes, allowing it to phone home to an IP address written as a single decimal number. This technique helps the data bypass traditional detection mechanisms.
Why it matters
The ability to spoof Googlebot identities undermines trust in automated verification processes. When nameservers validate false IPs, organisations may inadvertently grant access to malicious actors posing as legitimate crawlers. This can lead to unauthorised data access or prompt injection attacks.
The DNS-based exfiltration technique demonstrates how attackers can bypass common input validation rules. By encoding IP addresses as single decimal numbers and avoiding standard characters, the payload evades filters that look for typical malicious patterns. This increases the risk of sensitive data leaving the network undetected.
What happens next
Organisations should review their DNS configurations and bot verification processes. Teams need to ensure that forward confirmation checks are robust and not easily bypassed by fake PTR records. Monitoring for unusual outbound traffic to single decimal IP addresses is also recommended.
Security teams should assess their prompt injection defenses, particularly for systems that interact with AI agents. Verifying that all incoming bot traffic is authentic through multiple layers of validation can help mitigate the risk of impersonation. Regular audits of DNS records are essential to identify and remove any malicious PTR entries.
Patch priority
Teams usually prioritise systems that expose public-facing APIs or web applications to untrusted bot traffic. Check whether your organisation relies solely on forward DNS confirmation for bot validation, as this method may be insufficient. Review firewall rules to ensure they can detect and block outbound connections to unusual IP formats, such as single decimal numbers. Back up current DNS configurations before making changes to PTR records, and test any new filtering rules in a staging environment to prevent service disruption. Monitor logs for signs of prompt injection attempts or unexpected data exfiltration patterns.
Background: Data exfiltration
A data breach is an event where unauthorised access occurs. Data exfiltration is the subsequent transfer of that accessed information to an external destination. You can have a breach without exfiltration if the attacker is detected before copying files. You cannot have exfiltration without a prior breach of access controls.
Read the full guide: Difference Between Data Breach and Data Exfiltration: The Operational Truth
What to do and how to stay safe: Google
- Verify that bot traffic validation includes reverse DNS checks and not just forward confirmation to prevent impersonation.
- Implement strict input validation on all public endpoints to block payloads containing encoded IP addresses or unusual character combinations.
- Monitor outbound network traffic for connections to IP addresses formatted as single decimal numbers, which may indicate data exfiltration.
- Audit DNS records regularly to identify and remove any malicious PTR entries that could be used to redirect AI agents or bots.
Step-by-step guide: Prompt injection attacks prevention checklist for secure systems
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Google confirm the fake Googlebot issue?
The source material does not state whether Google has confirmed the issue or issued a statement regarding the fake Googlebot IPs.
How many fake Googlebots were found?
Researchers found twenty-eight fake Googlebot instances that passed forward confirmation checks according to the r/netsec report.
What makes the exfiltration payload effective?
The payload dodges filters for spaces, parentheses and quotes, and phones home to an IP written as one decimal number to evade detection.
