Published IP ranges

Verifying that a request really is GPTBot means fetching twelve different endpoints from six operators and parsing each one. This mirrors all of them into one schema, on one fetch, with the upstream timestamp and a SHA-256 of the bytes we received kept per source.

curl -s https://www.pathwren.workers.dev/ip-ranges/all.txt        # 2943 CIDRs, one per line
curl -s https://www.pathwren.workers.dev/ip-ranges/all.json       # same, grouped by source, with provenance
EndpointOperatorIPv4IPv6Operator timestampLast fetch
GPTBotOpenAI2102025-10-30ok
OAI-SearchBotOpenAI3502026-01-02ok
ChatGPT-UserOpenAI20402026-08-14ok
GooglebotGoogle1691462026-08-31ok
Google special-purpose crawlersGoogle1351352026-08-31ok
Google user-triggered fetchersGoogle5285282026-08-31ok
Google user-triggered fetchers (Google-owned ranges)Google2472472026-08-31ok
bingbotMicrosoft2802024-01-03ok
ApplebotApple3302026-07-31ok
DuckDuckBotDuckDuckGo48102026-07-03ok
PerplexityBotPerplexity802025-02-07ok
Perplexity-UserPerplexity402025-10-17ok

Operators that publish nothing (Anthropic, Common Crawl, Meta, ByteDance and most of the long tail) are absent by necessity — for those, user-agent is the only signal there is, and it is trivially spoofable. See /status.html for freshness.