How can I tell if a ChatGPT visitor is real?

OpenAI publishes the IP ranges ChatGPT-User, OAI-SearchBot and GPTBot use at openai.com/chatgpt-user.json, openai.com/searchbot.json and openai.com/gptbot.json. A request that names ChatGPT in its user agent but comes from an address outside those ranges did not come from OpenAI.

Is the user agent enough to identify an AI agent?

No. A user agent is text any program can send. Check the source IP against the operator's published ranges, or verify a Web Bot Auth signature when the agent sends one.

Do you store the IPs or logs I paste?

No. The check runs in your browser. The page downloads the public IP lists and compares locally; nothing you paste is sent anywhere.

Free tool · runs in your browser · nothing is uploaded

Is this really ChatGPT?

Anything can call itself ChatGPT. OpenAI, Anthropic and Perplexity publish the IP addresses their agents really use. Paste an address, or a whole access log, and see which visits were real and which were impostors.

Check one visit

Check a log file

Apache or Nginx access logs (combined format), Cloudflare or other JSON logs, or one "IP user-agent" per line. Up to 200,000 lines; for big logs, choose the file instead of pasting (it is read in your browser, never uploaded).

The official lists we check against

Loading the latest lists…

Operator	Agents	Ranges	Operator's list dated	We fetched it

Lists are fetched straight from each operator (links above) and refreshed every 6 hours. If we can't refresh a list for more than 3 days, we stop calling anyone an impostor against it. An operator can add addresses at any time, so a very new address may briefly show as an impostor until our next refresh. Private and reserved addresses (10.x, 192.168.x, 100.64.x…) always show "can't tell": they belong to a proxy or your own network, not the visitor. Only the agents listed above are judged; any other user agent is left out of the counts.

Questions

Why isn't the user agent enough?

It's a line of text the client chooses to send. In the first half of 2026 DataDome counted 7.9 million requests pretending to be ChatGPT-User, and 79.7% of about 700,000 sites let a fake ChatGPT straight through. DataDome Threat Research, July 2026

My site is behind Cloudflare or a load balancer. Which IP do I paste?

The visitor's address, not your proxy's. Cloudflare passes it in the CF-Connecting-IP header; most load balancers use the last entry in X-Forwarded-For. If your logs only show your proxy's addresses, every visit will show "can't tell" or look like an impostor.

Does "real" mean the request is safe?

It means the request came from the company it names. What that agent is allowed to do on your store is a separate decision.

What about agents that sign their requests?

Some agents sign their requests with Web Bot Auth, a cryptographic signature. Checking that needs the request headers, which a log file doesn't hold, so the ShopBouncer WooCommerce plugin checks signatures live and shows who signed (see it on the demo store).

Is my data sent anywhere?

No. This page downloads the public lists from shopbouncer.com and does every comparison in your browser. What you paste or choose never leaves your device.

Check every visit automatically

The free ShopBouncer plugin does this for every AI agent that visits your WooCommerce store, flags impostors, and keeps the identity check on every order an agent places. It never blocks a human visitor and stores no IP addresses.

Try it on a live demo store · Scan your store's AI readiness