What are published IP ranges?

By Nik Andreev, Founder & SEO specialist · Last reviewed · Editorial policy

Published IP ranges are lists of the IP blocks a bot operator says its crawler uses, usually a JSON file of CIDR prefixes. You verify a request by checking its source IP is inside the list for the bot it claims to be. OpenAI publishes one file per bot, and Google offers its files as an alternative to reverse DNS.

At a glance

Format
JSON with creationTime and a prefixes array of ipv4Prefix or ipv6Prefix entries
OpenAI files
openai.com/gptbot.json, searchbot.json, chatgpt-user.json, adsbot.json
Google files
common-crawlers.json, special-crawlers.json, user-triggered-fetchers.json, user-triggered-fetchers-google.json, user-triggered-agents.json
Google file location
developers.google.com/static/crawling/ipranges/
Standardization
Proposed in draft-illyes-webbotauth-jafar, an individual IETF draft (not adopted)
Main risk
Lists go stale. Refetch them regularly instead of hard-coding.

How it works

  • Pick the right list: use the file for the bot the user agent claims. A GPTBot request is checked against gptbot.json, not OpenAI’s other files.
  • Match the CIDR blocks: test whether the source IP falls inside any ipv4Prefix or ipv6Prefix. Outside every block means the claim fails.
  • Keep it fresh: each file carries a creationTime. Refetch on a schedule so new ranges pass and retired ones stop passing.
{
  "creationTime": "2026-09-22T02:00:07.000000",
  "prefixes": [
    { "ipv4Prefix": "20.171.206.0/24" },
    { "ipv4Prefix": "20.171.207.0/24" }
  ]
}

Other ways to verify a bot

FCrDNS Verifies through DNS instead of a list. Google supports both. Signed agent Proves identity with a signature, so no address list is needed. Verified bot What a bot becomes once one of these checks passes.

Quick answers

Is matching the cloud provider or ASN good enough?

No. Real bots often run on shared clouds, and spoofers can rent addresses on the same network. Match the operator's exact prefixes.

How often should I refresh the lists?

Often. Operators add and remove ranges as fleets change. Fetch the file on a schedule and cache it, rather than copying it once.

Why not just use reverse DNS?

Many AI operators do not publish reverse DNS. A list is easier for them to maintain and faster for you to check, with no live lookup.

Sources