Verifying that a request really is GPTBot means fetching 15 different endpoints from six operators and parsing each one. This mirrors all of them into one schema, on one fetch, with the upstream timestamp and a SHA-256 of the bytes we received kept per source.
curl -s https://www.pathwren.workers.dev/ip-ranges/all.txt # 3046 CIDRs, one per line curl -s https://www.pathwren.workers.dev/ip-ranges/all.json # same, grouped by source, with provenance
| Endpoint | Operator | IPv4 | IPv6 | Operator timestamp | Last fetch |
|---|---|---|---|---|---|
| GPTBot | OpenAI | 21 | 0 | 2025-10-30 | ok |
| OAI-SearchBot | OpenAI | 35 | 0 | 2026-01-02 | ok |
| ChatGPT-User | OpenAI | 204 | 0 | 2026-08-14 | ok |
| Googlebot | 170 | 147 | 2026-09-01 | ok | |
| Google special-purpose crawlers | 136 | 136 | 2026-09-01 | ok | |
| Google user-triggered fetchers | 529 | 529 | 2026-09-01 | ok | |
| Google user-triggered fetchers (Google-owned ranges) | 248 | 248 | 2026-09-01 | ok | |
| bingbot | Microsoft | 28 | 0 | 2024-01-03 | ok |
| Applebot | Apple | 33 | 0 | 2026-07-31 | ok |
| DuckDuckBot | DuckDuckGo | 486 | 0 | 2026-09-01 | ok |
| PerplexityBot | Perplexity | 8 | 0 | 2025-02-07 | ok |
| Perplexity-User | Perplexity | 4 | 0 | 2025-10-17 | ok |
| Google-Agent (agents on Google infrastructure) | 3 | 1 | 2026-03-03 | ok | |
| CCBot | Common Crawl | 4 | 1 | 2026-08-11 | ok |
| AhrefsBot and AhrefsSiteAudit | Ahrefs | 81 | 0 | — | ok |
Operators that publish nothing (Anthropic, Common Crawl, Meta, ByteDance and most of the long tail) are absent by necessity — for those, user-agent is the only signal there is, and it is trivially spoofable. See /status.html for freshness.