How to Find ChatGPT Bots in Your Server Logs

On 2026-11-09 we downloaded the three IP-range files OpenAI links from its bot documentation. Each file is a small JSON document with a creationTime and a list of prefixes. All three contained IPv4 prefixes only. The ChatGPT-User list is much longer than the other two and was only three days old when we fetched it, so these lists change. Download them fresh each time you check; do not copy ranges from a blog post, including this one.

Leadee's own bot catalogue (the list our log import and audits use) marks OAI-SearchBot, GPTBot, ChatGPT-User and OAI-AdsBot as verifiable by these IP lists. Two other OpenAI-related entries it carries, "ChatGPT Agent" and "OpenAI", come from a community list and have no published IP list we could check them against.

Why the IP check matters: in an earlier test the same day we requested the homepages of 8 Netbase-owned sites (the 7 sites of Netbase JSC plus leadee.ai, which is part of Netbase JSC) with the OAI-SearchBot and ChatGPT-User user agents, from our own server. All 8 answered HTTP 200. Anyone can do the same. In those sites' access logs, our requests would carry the same user agent as OpenAI's real bots; only the IP address, which is not in OpenAI's ranges, shows they were not OpenAI.

You need the raw request log, not Google Analytics. Bots do not run analytics scripts, so they never appear there. Where to find the log:

If your site sits behind a CDN or proxy (Cloudflare, a load balancer), the client IP in your origin server's log is usually the proxy's address, not the bot's. Use the CDN's own logs, or a log format that records the forwarded client IP. Otherwise the IP check in Step 3 will mark every request as unverified.

Each OpenAI bot puts its name in its user-agent string, as listed on OpenAI's bot page (checked 2026-11-09). For example, ChatGPT-User sends Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot. The version numbers change, so search for the name only: OAI-SearchBot, ChatGPT-User, GPTBot and, if you run ChatGPT ads, OAI-AdsBot.

These commands work on a combined-format log on Linux or macOS. Use zgrep instead of grep for rotated .gz files.

A matching user agent proves nothing on its own, as our test above shows. Check every IP against the list for that bot: OAI-SearchBot against https://openai.com/searchbot.json, GPTBot against https://openai.com/gptbot.json, ChatGPT-User against https://openai.com/chatgpt-user.json.

This short Python 3 script (standard library only) downloads the three lists and reads a combined-format log from standard input. Save the five lines as check_openai.py and run python3 check_openai.py < access.log. It prints one line per OpenAI-looking request: the bot, the IP, and whether that IP is inside the bot's published ranges. We tested it on a sample log on 2026-11-09. It expects the user agent to be the last quoted field. If your log format adds a field after it (some Nginx setups append the forwarded-for address), adjust the script first.

Once you know which lines are real, see which pages each bot reads. In the combined format the requested path is field 7 and the status code is field 9. If Step 3 showed spoofed requests, filter those IPs out first.

Look for your important pages: pricing, service and product pages, the pages you want ChatGPT to quote. If OAI-SearchBot keeps fetching old blog posts and never your main service page, check your internal links and sitemap. Our guide to writing pages ChatGPT can quote covers what to put on those pages once the bot reaches them.

A bot that visits but gets an error has not read your page. Count the status codes per bot: grep "ChatGPT-User" access.log | awk '{print $9}' | sort | uniq -c.

What the codes usually mean: 200 is a normal read; 301/302 is a redirect (fine if it leads to a 200); 403 means something refused the bot, often a firewall, CDN bot rule or security plugin; 429 means rate limiting; 5xx means your server failed. A row of 403s for a verified OpenAI IP is the case to fix. Allow-list that bot in the firewall or CDN, not only in robots.txt.

If the bot does not appear at all, the block may sit in front of your server where your log never sees it, or robots.txt tells it not to come. Check robots.txt with the ChatGPT Bot Access Test above, and see robots.txt rules for AI crawlers for the exact rules.

The three bots do different jobs, so their visits mean different things. The full comparison is in OAI-SearchBot vs GPTBot vs ChatGPT-User.

Logs show that OpenAI read your pages. They do not show what ChatGPT said. For that, ask the buyer questions you care about several times and count how often your brand is named and your page cited. Our guides on checking if ChatGPT mentions your brand and keeping a prompt tracking sheet show how.

If you want the bot counts without the command line, Leadee's AI Traffic module imports Apache/Nginx combined logs (also with a trailing forwarded-for field) and Cloudflare JSON lines, and counts AI bot hits by bot, page and status code. It drops client IPs while parsing and does not store them. It matches bots by user agent only, so it does not do the IP check from Step 3. Run that check yourself if spoofed requests matter to you. Where these logs fit in the wider picture is on the ChatGPT SEO overview.