"Googlebot" has no reason to access xmlrpc.php
You could add this to the top of your xmlrpc.php

// Block fake Googlebot
if ( strpos($_SERVER['HTTP_USER_AGENT'], "Googlebot") === true ) { exit(); }


I'm guessing it's a core WordPress file. So it might be annoying to keep this updated. Would be nice if Automattic used Akismet to blacklist these IPs from all WP scripts, everywhere.

Many POST requests to /xmlrpc.php from GoogleBot taking down server?
Given something in a state of not having been validated or invalidated, its validness is, as yet, unknown. Can it be said to be unvalidated? If not, what is the proper term?
