Bot management vendor
Google Cloud Fraud Defense
In short
Google Cloud Fraud Defense reports verified and suspected agent sessions side by side, treating as suspected any session that declares itself through headers or behaves like an agent without being verifiable. It plugs into Cloud Armor, Fastly and Cloudflare at the WAF layer, deciding by signature where one exists or else by matching the user agent to published addresses.
- Type
- Bot management
- Operator
- Homepage
- cloud.google.com
- In one line
- Google Cloud's bot and fraud service, the evolution of reCAPTCHA, which verifies AI agents by Web Bot Auth signature or by user agent matched to published IP ranges or reverse DNS, and reports verified and suspected agent sessions.
- Last read
- 2026-11-05
What Google Cloud Fraud Defense does for this layer
From the vendor's own pages
Google Cloud Fraud Defense classifies agent traffic with two verification methods: Web Bot Auth signatures, and the User-Agent string checked against the source IP address. (docs.cloud.google.com, dated 2026-10-26) Google counts sessions that self-declare as agents, for example through HTTP headers, or behave like agents but cannot be verified, as suspected agent sessions. (docs.cloud.google.com, dated 2026-10-26) Google's Fraud Defense post calls Web Bot Auth its preferred standard for agents and bot operators, and says Fraud Defense also validates declared user agents against published egress IP blocks and reverse DNS records. (security.googlecloudcommunity.com) reCAPTCHA in Fraud Defense is free up to 10,000 assessments a month per organization, then a USD 8 flat fee up to 100,000, then USD 1 per 1,000 assessments. (cloud.google.com)
Google's reCAPTCHA page says it integrates at the WAF layer with Google Cloud Armor, Fastly and Cloudflare, and combines with Cloud Armor and Apigee in Google's WAAP offering. (cloud.google.com)
Claims the vendor makes about itself
Google says an operator that signs with Web Bot Auth builds a reputation that extends across the 14 million+ websites protected by Fraud Defense. (security.googlecloudcommunity.com)
Products and plans
| Product | What it does | Price model | From | As of |
|---|---|---|---|---|
| Google Cloud Fraud Defense (reCAPTCHA) | Bot and agent assessments with an Agent overview dashboard and policy controls. | per assessment | USD 0 | 2026-11-05 |
| Google Cloud Armor | WAF that can call reCAPTCHA for bot management at the edge. | |||
Standards
| Standard | Status | Evidence |
|---|---|---|
| Web Bot Auth | Supports | Fraud Defense verifies Web Bot Auth signatures and calls it the preferred standard. (security.googlecloudcommunity.com) |
| Published IP list | Supports | Declared user agents are checked against published egress IP blocks. (security.googlecloudcommunity.com) |
| Reverse DNS check | Supports | Declared user agents are also checked against reverse DNS records. (security.googlecloudcommunity.com) |
| Visa Trusted Agent Protocol | No statement | No statement on the Fraud Defense pages read 2026-11-05. |
| Mastercard Agent Pay | No statement | No statement on the Fraud Defense pages read 2026-11-05. |
Our checks
| Check | Result | Method | Date |
|---|---|---|---|
| Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 |
What Google Cloud Fraud Defense does not do
- Fraud Defense's Agent overview only covers the last 30 days or the current month.
- Fraud Defense offers no charging or licensing route for AI crawlers.
Reading notes
Google also runs crawlers, covered on Google's own profile; this one covers only the bot-management product.
Related pages on this site
Sources
Last reviewed 2026-11-05