Skip to content
Spaw
Get your API key

GPTBot IP ranges

Crawls pages whose content may be used to train OpenAI's models; publishers opt out through robots.txt. OpenAI publishes the address ranges GPTBot crawls from so sites can tell it from a scraper carrying its name. This is that file, synced daily by the same job that feeds the IP lookup, with the date of the copy and how to check a visitor against it.

GPTBot at a glance

OperatorOpenAI
What it doesAI training
Answered ascrawler: GPTBot · crawler_kind: ai_training
Published filehttps://openai.com/gptbot.json
Prefixes today21 IPv4, 0 IPv6
Copy synced2026-09-12

The ranges

Every prefix in OpenAI's file as of 2026-09-12, IPv4 first, each family in address order. An address inside any of them is GPTBot as far as its operator is concerned.

IPv4 · 21

4.227.36.0/25
20.125.66.80/28
20.171.206.0/24
20.171.207.0/24
52.230.152.0/24
74.7.175.128/25
74.7.227.0/25
74.7.227.128/25
74.7.228.0/25
74.7.230.0/25
74.7.241.0/25
74.7.241.128/25
74.7.242.0/25
74.7.243.128/25
74.7.244.0/25
132.196.86.0/24
172.182.202.0/25
172.182.204.0/24
172.182.207.0/25
172.182.214.0/24
172.182.215.0/24

IPv6 · 0

—

How to verify a visitor is GPTBot

Take the request's source address and check it against the prefixes above; the User-Agent header is a claim anyone can type and proves nothing on its own. OpenAI documents the ranges as the way to verify GPTBot; a reverse DNS name is not part of its guidance, so do not rely on one.

What the API answers for one of its addresses

A lookup of an address inside these ranges answers is_crawler true, names it in crawler and classes it in crawler_kind. A crawler carries no risk weight, and the datacenter weight is skipped for it: its operator is known and its infrastructure is the point. 

curl https://spaw.co/api/v1/ip \
  -H "Authorization: Bearer $SPAW_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip": "4.227.36.0"}'
"is_crawler": true,
"crawler": "GPTBot",
"crawler_kind": "ai_training",
"risk_signals": [{ "signal": "datacenter", "weight": 0, "dataset": "datacenter-ranges" }]

A range proves the operator, not intent. Whether GPTBot is welcome on a site is a robots.txt decision; this page and the lookup only settle whether a request that says it is GPTBot really came from OpenAI.

Other crawlers

crawler-ranges 2026-09-12 · checked 2026-09-13

Wrong result, or is it about you? If this tool said something you think is wrong, tell us and a person reads it. If Spaw is holding data about you and you never signed up here — a customer may have had your address verified, or reported that a message to it bounced — erase it yourself, confirmed by mail to that address and with no account needed.

More free tools

All free tools

Need this at scale?

The Spaw API answers is_crawler, the crawler's name and its kind for any address, from these ranges and a forward-confirmed reverse DNS check — 10 free lookups a month, no card required.

Get your API key