I keep stumbling over different Google bots in my logs. So today I'm looking at each and every Googly eye that takes a look at my site. Because when you stare at me, I'll stare back.

You have the right and the means to define what Google is allowed to do on your site, whether the Google traffic you face is extensive or you'd like to opt-out of AI training (check Google Other). Sadly, using robots.txt is not enough, Google admits that some of their bots will not respect the rules.

Previous articles were about TLS fingerprinting JA3/JA4 and how to deploy it on HAProxy. In this article/marimo notebook (full source) I'll use the HAProxy logs containing IP addresses (plus ASNs), user agents and JA4 hashes to examine Google traffic. We'll see a couple of Google bots that are not mentioned in their docs.