OpenAI crawlers IP Ranges
OpenAI runs three robots and publishes a separate address list for each: GPTBot, which collects pages for model training, OAI-SearchBot, which indexes pages for ChatGPT's search results, and ChatGPT-User, which fetches a page when a person using ChatGPT asks for it. Between them the three files list 285 distinct IPv4 prefixes and no IPv6. OpenAI has no network of its own here: every prefix sampled resolves to Microsoft's AS8075, so the robots run on Azure, and a WHOIS lookup on any of these addresses names Microsoft rather than OpenAI.
- Provider
- OpenAI crawlers
- Hosting network
- AS8075 (Microsoft Azure, host)
- Category
- Crawler
- Headquarters
- San Francisco, CA, USA
- Published IPv4 prefixes
- 285
- Registry
- Self-published list
Known IP ranges
OpenAI does not announce these addresses under an ASN of its own. They are the prefixes it publishes in https://openai.com/gptbot.json, https://openai.com/chatgpt-user.json, https://openai.com/searchbot.json, as fetched on 2026-10-16; the space itself is routed by AS8075 (Microsoft Azure). The list decides whether an address belongs to OpenAI crawlers - WHOIS for any of them returns the host network.
9.129.0.0/17
20.171.206.0/24
20.171.207.0/24
51.8.102.0/24
52.230.152.0/24
132.196.86.0/24
135.234.64.0/24
4.227.36.0/25
20.169.77.0/25
40.67.175.0/25
What does an OpenAI crawlers IP mean in a privacy test?
An OpenAI crawler address is a robot fetching a page, not a person, so it never means a visitor's VPN has failed. It tells a site owner which of OpenAI's three robots reached them, and that answer only holds if the address is in the matching list, because the user-agent string can be copied by anyone.
The three lists and what each one holds
The lists live at openai.com/gptbot.json, openai.com/searchbot.json and openai.com/chatgpt-user.json, each with a creationTime stamp. On 16 October 2026 they read 22 September 2026 for GPTBot, 2 January 2026 for OAI-SearchBot and 7 October 2026 for ChatGPT-User, so the three are maintained on separate schedules and a check against one says nothing about the freshness of the others.
They are not the same size. GPTBot lists 18 prefixes, four /24s, thirteen /25s and one /28. OAI-SearchBot lists 39, of which six are the very same /25 and /24 blocks GPTBot uses, among them 4.227.36.0/25 and 74.7.228.0/25, so an address there can be either robot and the user-agent decides which. ChatGPT-User lists 234 prefixes that overlap neither of the other two: 233 are /28s, sixteen addresses each, and one is 9.129.0.0/17, which on its own is 32,768 of the 40,992 addresses the three files cover once overlaps are merged.
Telling the three robots apart in a log
The user-agent token names the robot, and the list confirms it. A request that says GPTBot from an address in gptbot.json is OpenAI's training crawler; the same claim from an address in none of the three lists is someone using the name. The six shared blocks are the one place the address alone cannot separate GPTBot from OAI-SearchBot.
The two also differ in what blocking them costs. GPTBot gathers training data, so refusing it in robots.txt keeps pages out of future training sets without touching search. OAI-SearchBot is what puts a page into ChatGPT's search answers, so refusing it removes the site from those answers. ChatGPT-User acts on a person's request in the moment, which is why its list is by far the largest and why it changes most often.
Related tools
Frequently asked questions
What IP ranges does GPTBot use?
The 18 prefixes in openai.com/gptbot.json: four /24s, thirteen /25s and one /28, all routed by Microsoft's AS8075. Six of them are shared with OAI-SearchBot, so check the user-agent as well as the address.
Why does an OpenAI crawler address appear in my logs or a privacy test?
An OpenAI crawler address is a robot fetching a page, not a person, so it never means a visitor's VPN has failed. It tells a site owner which of OpenAI's three robots reached them, and that answer only holds if the address is in the matching list, because the user-agent string can be copied by anyone.
Why does WHOIS say Microsoft for an OpenAI crawler address?
Because the space belongs to Microsoft. OpenAI runs these robots on Azure and publishes the slices it uses; the registry record describes the network owner, not the tenant. Every prefix sampled from the three lists on 16 October 2026 resolved to AS8075.
Is 9.129.0.0/17 really an OpenAI range?
It is listed in chatgpt-user.json, OpenAI's own file, and RIPEstat shows it announced by AS8075, Microsoft. It is the largest single entry across the three lists: 32,768 addresses, about 80% of everything they cover.
Does blocking GPTBot remove a site from ChatGPT search?
No. Search results come from OAI-SearchBot, which has its own robots.txt token and its own list. Blocking GPTBot keeps pages out of training data; blocking OAI-SearchBot is what takes them out of search answers.