I have an error checker on my password reset page which tells me everytime someone comes to reset their password without a valid token.
I have noticed within the last couple of days that the AdsBot-Google has been spamming this page quite regularly (since the sites launch) with invalid, yet with a valid format, tokens (don't ask me where it got them).
I have checked the validity of the user agent by pinging the originating server (18.104.22.168) and checkig its SSL cert (since all Google bots now use SSL).
Some sites say that the Ads bot scans an ad's landing page, however, my password reset page is defintely not used as a landing page for any of my ads.
I read about this on a Google search but, as usual, every site contradicts the other.
Should I block the bot from this page if it is not needed?
Is it good practice to block the google ads bot on certain pages or is there another reason this is happening?