DuckDuckBot IP Ranges
DuckDuckBot is the web crawler run by DuckDuckGo, the privacy-focused search engine. DuckDuckGo publishes its addresses in an unusual form: 486 individual IPv4 addresses, each listed as a /32, rather than network blocks. All of them are on Microsoft's AS8075, so the crawler runs on Azure, and a WHOIS lookup on one of these addresses names Microsoft rather than DuckDuckGo.
- Provider
- DuckDuckBot
- Hosting network
- AS8075 (Microsoft Azure, host)
- Category
- Crawler
- Headquarters
- Paoli, PA, USA
- Published IPv4 prefixes
- 486
- Registry
- Self-published list
Known IP ranges
DuckDuckGo does not announce these addresses under an ASN of its own. They are the prefixes it publishes in https://duckduckgo.com/duckduckbot.json, as fetched on 2026-10-16; the space itself is routed by AS8075 (Microsoft Azure). The list decides whether an address belongs to DuckDuckBot - WHOIS for any of them returns the host network.
4.144.148.23/32
4.144.182.50/32
4.144.227.142/32
4.144.251.39/32
4.149.142.7/32
4.149.159.71/32
4.149.159.102/32
4.149.216.220/32
4.150.142.218/32
4.154.193.167/32
What does a DuckDuckBot IP mean in a privacy test?
A DuckDuckBot address is DuckDuckGo's crawler reading a page, never a person. Because the list names exact addresses, a match is precise: an Azure address one number away from a listed one is not DuckDuckBot.
A list of hosts, not ranges
The file is duckduckgo.com/duckduckbot.json, and its creationTime read 1 September 2026 when fetched on 16 October 2026. Every one of its 486 entries is a /32, a single machine, starting with 4.144.148.23/32. That makes the list the largest by entries among the crawlers here after Google, and the smallest by address space per entry.
The addresses are scattered across Azure: 194 begin with 20, 86 with 52, 40 with 4 and 38 with 51. A firewall rule built from this list has to carry all 486 entries, because there is no enclosing range that would match only DuckDuckBot.
DuckDuckBot on a crowded network
AS8075 is shared with Bingbot, the OpenAI crawlers and every Azure customer, so a Microsoft address in a log could be any of them. With DuckDuckBot the list does all the work: an address either appears in it exactly or it is not DuckDuckGo's crawler.
The precision cuts both ways. Because DuckDuckGo names machines rather than blocks, its list changes whenever those machines change, so a copy saved months ago will miss new crawler hosts. Re-fetching it before trusting a negative match is the safe practice.
Related tools
Frequently asked questions
What IP addresses does DuckDuckBot use?
The 486 single addresses in duckduckgo.com/duckduckbot.json, each listed as a /32, all on Microsoft's AS8075. There are no ranges and no IPv6 entries.
Why does a DuckDuckBot address appear in my logs or a privacy test?
A DuckDuckBot address is DuckDuckGo's crawler reading a page, never a person. Because the list names exact addresses, a match is precise: an Azure address one number away from a listed one is not DuckDuckBot.
Why does WHOIS say Microsoft for a DuckDuckBot address?
DuckDuckGo runs its crawler on Azure. The registry describes the network owner, so a lookup names Microsoft; the published list is what identifies the address as DuckDuckBot.
Why does DuckDuckGo list single addresses instead of ranges?
Its crawler runs on individual Azure machines rather than a dedicated block, so the exact hosts are the only accurate description. It also means the list has to be re-fetched as those hosts change.
Is DuckDuckBot the same as Bingbot?
No. DuckDuckGo licenses results from Bing among other sources, but DuckDuckBot is its own crawler with its own user-agent and its own list of 486 addresses, separate from the 28 prefixes in bingbot.json.