Open your website’s access log, find the lines that name GPTBot, OAI-SearchBot or ChatGPT-User, and write down the address each one came from. Then check that address against the lists OpenAI publishes at openai.com/gptbot.json, openai.com/searchbot.json and openai.com/chatgpt-user.json. On the list, the visit was real. Not on the list, something else typed the name.
The name in your log is not proof
Almost every visitor to your site sends a short line of text saying what it is. Your server writes that line down. That is where “GPTBot” in your log comes from. It is a label the visitor chose for itself.
Nothing stops anyone sending any label they like. The rulebook for how web requests work, RFC 9110, published June 2022, has a paragraph telling a server what it may assume when a visitor “masquerades as a different user agent”. The people who wrote the rules expected the label to be wrong sometimes.
So the name tells you what a visit claims to be. The address it came from is the part you can check against something.
Where OpenAI publishes the real addresses
OpenAI keeps a page in its developer documentation listing the programs it runs on the open web. That page carries no update date. It names four, and gives an address file for each one:
- GPTBot collects pages that may be used to train models. Addresses at openai.com/gptbot.json.
- OAI-SearchBot is the one tied to ChatGPT’s search results. Addresses at openai.com/searchbot.json.
- ChatGPT-User fetches a page when a person in a chat asks for something. Addresses at openai.com/chatgpt-user.json.
- OAI-AdsBot checks pages submitted as ads. Addresses at openai.com/adsbot.json.
Each file is a plain list of address blocks with a timestamp at the top. You can open all four in a browser right now, no account needed. When this was written, gptbot.json held 21 blocks and was stamped October 30, 2025. searchbot.json held 35 blocks, stamped January 2, 2026. chatgpt-user.json held 204 blocks, stamped August 14, 2026. adsbot.json held 2.
Those counts move. The ChatGPT-User file carried the newest stamp of the four when this was written. Read the stamp at the top of the file before you trust a copy you saved last month.
Anthropic runs the same setup for Claude. Its help page, dated April 7, 2026, names three programs, ClaudeBot, Claude-User and Claude-SearchBot, and says that a crawler with a source address on its published list is coming from Anthropic. That list sits at claude.com/crawling/bots.json and held 23 blocks when this was written, stamped August 13, 2026.
Reading a block like 20.171.206.0/24
The lists are not single addresses. They are ranges, written with a slash and a number on the end.
A /24 covers 256 addresses and only the first three numbers have to match. So 20.171.206.0/24, a real line in OpenAI’s GPTBot file, matches any visitor whose address starts 20.171.206. A /25 is half of that. A /28 is 16 addresses. A /32 is one exact address and nothing else.
If arithmetic on address ranges is not how you want to spend an evening, that is fair. Paste the address and the block into a search and ask whether one sits inside the other, or hand both to whoever looks after your site. The point is that you end up comparing a number against a published number instead of taking a name on trust.
What each of the three names actually means
A visit is not a visit. The three tell you different things, and they are easy to mix up.
GPTBot in your log means pages were collected that may be used to train models. It says nothing about whether ChatGPT will name your business when somebody asks who fixes a burst pipe at nine at night.
OAI-SearchBot is the one that matters for search. OpenAI’s page says sites opted out of it will not be shown in ChatGPT search answers, though they can still turn up as plain navigational links.
ChatGPT-User is a person. Somebody in a chat asked for something and ChatGPT went and got the page. OpenAI’s page says plainly that ChatGPT-User is not used to decide whether content may appear in search, and that robots.txt rules may not apply to it, after a person asked for the visit. So a hundred of those lines is not evidence that you sit in the search index.
If none of the three has ever shown up in your log, the next question is whether something is turning them away at the door. That starts with your own robots.txt file and your host’s default settings, and whether your site is blocked from ChatGPT is worth ruling out before you decide nobody came.
What this check will never tell you
It tells you a machine fetched a page. That is all. It cannot tell you whether an assistant named your business to a customer, and no log line anywhere will. Finding that out means asking the assistants the question a customer would ask and writing down who gets named, which is what the free scan does. It will not tell you whether anyone arrived from an AI answer either. That is a different number in a different place, and where visits from AI answers show up is the one to read next.
Some hosting plans hand you a traffic graph and no raw access log. Without the raw log you cannot see visitor addresses, and this check is simply not available to you. Do not go buy a crawler tracking product over it. Ask your host whether raw logs can be turned on before you spend anything.
One caution before you switch on log keeping and forget about it. An access log records the address of every visitor, your customers included. How long you may keep that, and what your privacy policy has to say about it, depends on your state, and whether you need one of those at all is worth settling first. This is not legal or tax advice. Ask an attorney in your own state.
And the evidence has a soft edge. OpenAI’s page carries no update date, and neither file set explains how often it changes. An address that is genuine today can drop off the list next month, which would make an old visit look fake when it never was.
What to do next
Do it in this order and stop as soon as you have your answer.
- Ask your host for the raw access log for the last 30 days. Say “raw access log”, not “analytics”.
- Search it for GPTBot, OAI-SearchBot and ChatGPT-User. Note the address on each line.
- Open the matching file at openai.com and check whether the address falls inside one of the listed blocks.
- Anything claiming to be OpenAI from an address that is not on the list is somebody else wearing the name. Treat it as ordinary traffic, the same as the failed logins that fill a WordPress log.
- If the real programs are visiting and the pages they get are thin or slow, that is the thing to fix, and it calls for ongoing search checks, not a one time job.
If the log shows nothing at all, go and read your robots.txt before you assume the worst. A door held shut looks exactly like a door nobody knocked on.