Published IP ranges

Verifying that a request really is GPTBot means fetching 15 different endpoints from six operators and parsing each one. This mirrors all of them into one schema, on one fetch, with the upstream timestamp and a SHA-256 of the bytes we received kept per source.

curl -s https://www.pathwren.workers.dev/ip-ranges/all.txt        # 3046 CIDRs, one per line
curl -s https://www.pathwren.workers.dev/ip-ranges/all.json       # same, grouped by source, with provenance
EndpointOperatorIPv4IPv6Operator timestampLast fetch
GPTBotOpenAI2102025-10-30ok
OAI-SearchBotOpenAI3502026-01-02ok
ChatGPT-UserOpenAI20402026-08-14ok
GooglebotGoogle1701472026-09-01ok
Google special-purpose crawlersGoogle1361362026-09-01ok
Google user-triggered fetchersGoogle5295292026-09-01ok
Google user-triggered fetchers (Google-owned ranges)Google2482482026-09-01ok
bingbotMicrosoft2802024-01-03ok
ApplebotApple3302026-07-31ok
DuckDuckBotDuckDuckGo48602026-09-01ok
PerplexityBotPerplexity802025-02-07ok
Perplexity-UserPerplexity402025-10-17ok
Google-Agent (agents on Google infrastructure)Google312026-03-03ok
CCBotCommon Crawl412026-08-11ok
AhrefsBot and AhrefsSiteAuditAhrefs810ok

Operators that publish nothing (Anthropic, Common Crawl, Meta, ByteDance and most of the long tail) are absent by necessity — for those, user-agent is the only signal there is, and it is trivially spoofable. See /status.html for freshness.