A User-Agent string is free text; anything can call itself Googlebot. What cannot be forged is the address it comes from. Operators publish two kinds of proof: a reverse DNS name under their own domain that resolves back to the same address, and JSON lists of the address ranges their crawlers use. This check does both from this server, refreshes the lists once a day, and asks RDAP who owns the network, so a scraper on a rented cloud machine stands out from the real thing.
From this server: a reverse DNS lookup, a forward lookup of the resulting name, one RDAP query for the address, and, at most once a day, the public range lists of the crawler operators. The address entered is not contacted. The query is protected by reCAPTCHA v3; the calling IP address and the address checked are stored for one hour to limit the rate.
Limits worth knowing: not every operator publishes anything (ClaudeBot, CCBot, Bytespider have neither lists nor reverse DNS conventions, so their claims are unverifiable rather than false); the lists are refreshed daily and an address added today may be missing until tomorrow; the data centre hint comes from the network name and is a heuristic; and a confirmed crawler address says nothing about whether the request itself was welcome.