Is that really an AI crawler?

Because the client chooses it. A user-agent is a string the requester sends about itself, with nothing stopping anyone from sending GPTBot. Scrapers do this deliberately, since site owners write permissive rules for named AI crawlers. Any count of AI crawler traffic taken from user-agent strings alone is a count of claims.

Two ways. Some operators publish the IP ranges their crawlers use, so the address either falls inside a published range or it does not. Where no ranges are published, the check is reverse DNS: look up the hostname for the address, confirm it belongs to the operator's domain, then resolve that hostname forward and confirm it returns the original address. The forward step is essential, because reverse DNS is controlled by whoever owns the address block.

No, and the difference matters. Unverified means nothing here confirms or refutes the claim: the operator may publish no ranges, DNS may have failed, or there may be no address to check. Calling a legitimate crawler an impersonator is a worse error than declining to answer, so this tool declines.

Usually yes for anything claiming to be a crawler and failing a definitive range check, since that is an impersonator by definition. Be more careful with unverified results, and be aware that blocking by user-agent is weak either way: the impersonator can simply change the string. Verification is most useful for understanding your logs and for rules enforced at the IP level.

It means that crawler fetched that page. What happens next depends on the agent. GPTBot and ClaudeBot gather training data, OAI-SearchBot and Claude-SearchBot build search indexes, and the -User agents fetch a page live during a conversation. Those are different uses and robots.txt controls them separately.