Google-InspectionTool

Its full user-agent string, exactly as it arrives at the gate:

To check a visitor really is Google-InspectionTool, run a reverse DNS lookup on its IP address and confirm the hostname ends in .googlebot.com, .google.com, .googleusercontent.com. Then run a forward lookup on that hostname and check it returns the same IP. Anything that fails is an impostor; the zoo checks every visit this way and files the failures in the Trap Room.

Add these two lines to the robots.txt file at the root of your site. Well-behaved crawlers read it before they crawl, so the change applies from Google-InspectionTool's next visit. Nothing else on your site needs to change.

# Block Google-InspectionTool from the whole site
User-agent: Google-InspectionTool
Disallow: /

Blocking it stops Search Console from testing your pages. It does not affect Google Search itself.

Or let it visit but keep it away from part of the site:

# Let it in, but keep it out of one room
User-agent: Google-InspectionTool
Allow: /
Disallow: /members/

Requests that use Google-InspectionTool's name but fail Google's network check are filed separately, as impostors. These are the visits that passed, or that could not be checked at the time:

Networks and countries come from the visitor's IP address, looked up in a local copy of the DB-IP database. The addresses themselves are never stored.