Guides · 2026-10-18 · By VSNARY | Emmanuel Orta

How to verify Amazonbot and Amzn-SearchBot by IP address

Anyone can put Amazonbot in a user agent. Amazon publishes the addresses its crawlers really use, as a list on a web page. Here is how to check a request against it, and what we found when we started checking.

A user agent is a line of text the client chooses. Anyone can send one that says Amazonbot. The only reliable test is where the request came from: the operator's own published addresses, or somewhere else. This guide covers Amazon's two crawlers. The general verification guide covers the others.

Amazon's two crawlers #

The lists are web pages, not files #

Most operators publish crawler addresses as a JSON file at a stable URL. Amazon publishes them inside a web page: the page carries a JSON block with a creationTime and a prefixes array. On 18 October 2026 the Amazonbot page listed 1,292 entries and the Amzn-SearchBot page 816. The two pages use different shapes. Amazonbot entries are single IPv4 addresses with no mask ("ipv4Prefix": "3.81.245.78"); Amzn-SearchBot entries carry a /32 ("ip_prefix": "3.82.67.224/32"). A tool that expects a plain JSON file will fail to read either, which is how CrawlCheck came to list Amazonbot as unverifiable for two months.

How to check one request #

1. Take the source address from your log. Behind a CDN, use the header it adds for the client address, not the CDN's own.
2. Fetch the list page for the crawler the user agent names and extract every address from the JSON block.
3. Treat a bare address as a single host (/32 for IPv4).
4. If the source address is on the list, the request is Amazon's crawler. If the user agent names Amazonbot and the address is not on the list, it is not Amazon.
5. Refresh your copy of the list regularly; Amazon updates it, and each copy carries its creation time.

Or send the address and user agent to Visitor Resolve, which answers verified, spoofed or unverifiable from the same lists, signed.

What we saw when we started checking #

Until 18 October 2026, CrawlCheck counted every request naming Amazonbot on crawlcheck.io as unverifiable: 45,044 of them over two months, none of which could be tied to Amazon or ruled out. Within the first hour of reading Amazon's list, the picture split. Requests from Amazon's own address space verified. A steady stream of requests naming Amazonbot from a Cloudflare network address, walking pages such as our dataset and registry pages every few seconds, did not. Those are now counted as forged claims, against whoever sent them, never against Amazon.

The earlier 45,044 stay unverifiable: the addresses were not kept, so they cannot be judged after the fact. The live counts are on the agent conduct page.

What to do with a failed check #

A request that fails verification is not Amazon, so blocking it costs Amazon's real crawler nothing. Before blocking, check that you are reading the client address and not your CDN's, and that your copy of the list is current. A stale list turns new Amazon addresses into false failures.

Robots.txt rules aimed at Amazonbot apply to Amazon's crawler, which reads and obeys them. They do nothing to a client that only borrows the name. The post on forged crawler traffic covers how common that is across operators, and how to verify GPTBot, ClaudeBot and PerplexityBot covers the other AI crawlers.

Related findings

Comments

Comments are read before they appear. Nothing is published automatically, and no account is needed.

Writing about this? Facts, live figures and marks — every number on that page is dated and traceable to a scan.

All guides · The dataset · How the dataset works