AI crawler · user agent GPTBot

GPTBot (OpenAI) IP addresses

GPTBot is OpenAI's crawler for collecting training data. It respects robots.txt, so you can opt out with a Disallow rule for GPTBot.

IPv4 prefixes: 18
IPv6 prefixes: 0
IPv4 addresses: 2,704
Updated: Oct 1, 2026

Is this IP GPTBot (OpenAI)?

Checks the address against the current list, in your browser.

Download the list

Generated from the current list.

Source: https://openai.com/gptbot.json · official documentation

All prefixes

The list as of Oct 1, 2026; the page loads the latest copy when it opens.

Prefix
4.227.36.0/25
20.125.66.80/28
20.171.206.0/24
20.171.207.0/24
52.230.152.0/24
74.7.175.128/25
74.7.227.0/25
74.7.227.128/25
74.7.228.0/25
74.7.230.0/25
74.7.241.0/25
74.7.241.128/25
74.7.242.0/25
74.7.243.128/25
74.7.244.0/25
132.196.86.0/24
172.182.202.0/25
172.182.207.0/25

Verifying GPTBot (OpenAI)

The user agent string GPTBot can be faked by anyone, and scrapers often pretend to be well-known bots to get past rate limits. Before you treat a request as GPTBot (OpenAI):

Check that the request IP is inside one of the prefixes above (the checker on this page does exactly that).
Load the list from its source on a schedule; do not hard-code it.
Allow the verified bot in your firewall or bot protection, and rate-limit or challenge requests that only claim to be it.

To control access, use robots.txt: User-agent: GPTBot followed by Disallow: / blocks the bot entirely; a path-specific Disallow excludes only parts of your site.

Frequently asked questions

What are the IP ranges of GPTBot (OpenAI)?

GPTBot (OpenAI) publishes 18 IPv4 and 0 IPv6 prefixes (2,704 IPv4 addresses in total) in its official list at https://openai.com/gptbot.json. This page shows the list as of Oct 1, 2026 and loads the latest copy when it opens.

How do I verify that a request really comes from GPTBot (OpenAI)?

Anyone can send the user agent GPTBot. Check that the IP address of the request is in the list (use the checker on this page), or do a reverse DNS lookup followed by a forward lookup, as described in the official documentation.

How often do the GPTBot (OpenAI) IP ranges change?

Providers add and remove ranges regularly, sometimes several times a week. Do not hard-code the list: load it from its source (or this page's JSON) on a schedule, for example daily.

How do I allow only GPTBot (OpenAI) in nginx?

Download the nginx format on this page and include it in a location block: one 'allow' line per prefix followed by 'deny all;'. Regenerate the file regularly, because the list changes.

IP geolocation API

Know who is behind any IP

Beyond published lists, the ipbase API tells you the owner, ASN and location of every IP address, and on the Small plan and above its data-center and VPN status, so you can recognise cloud traffic and bots from any provider.

Read the documentation

150 free requests every month. No credit card required.

GET https://api.ipbase.com/v2/info?ip=1.1.1.1

{
  "data": {
    "ip": "1.1.1.1",
    "type": "v4",
    "connection": {
      "asn": 13335,
      "organization": "APNIC and Cloudflare DNS Resolver project",
      "isp": "Cloudflare, Inc",
      "range": "1.1.1.0/24"
    },
    "location": {
      "country": { "alpha2": "AU", "name": "Australia" },
      "zip": "4000"
    },
    "security": { "is_vpn": null, "is_tor": null, "threat_score": null }
  }
}