DotBot (Moz) — the verified crawler range, four-source methodology and why the whole /24
by shop owners for shop owners.
The IP range of the Moz crawler DotBot (Moz Link Explorer) to block or allowlist — plus why Moz publishes no official IP list and how we verified the range 216.244.66.0/24 across four independent sources, including our own SafeLine WAF telemetry.
DotBot is Moz's crawler for the link index behind Moz Link Explorer — it collects backlink data (Domain/Page Authority) that Moz sells to paying customers. Moz publishes no official IP list. So we verified the active range across four independent sources — including our own WAF telemetry — and pinned it to a single /24. Part of our PARC Security feed.
dotbot.json — view feed Moz docs on DotBot →
The range
A single entry — 216.244.66.0/24 (256 IPs), Wowrack pool in Seattle, AS23033:
216.244.66.0/24
No aggregate of dozens of subnets, no scattered /32 list: one clean, fully occupied crawler pool.
No official list — Moz says “block by user-agent”
Moz publishes no IP range for DotBot; the support line is essentially “the IPs change, block by user-agent”. A reverse DNS against *.moz.com doesn’t work either — the crawler IPs carry no moz.com PTR. So verification has to come from the outside. That’s exactly what we did.
Four sources, one consensus
| Source | Finding |
|---|---|
| 1 · Multilingual research (8 languages: DE/EN/RU/FR/ES/CN/IT/JP) | Third-party sources (webrobots.de, Cloudflare Radar, DataDome, BotDetector, darkvisitors, forums). Active cluster clearly in 216.244.66.x. |
| 2 · Our own SafeLine telemetry (60 h, 10,495 blocked hits) | Across all multi-tenant shops, every blocked DotBot request came from one /24: 216.244.66.0/24. Zero hits from other pools. |
| 3 · Subnet scan (ICMP + reverse DNS, all 256 IPs) | 256/256 alive, 0 customer hostnames in the /24 — a clean crawler pool with no third parties. |
| 4 · Cleantalk spam DB | 35 IPs in the same /24 currently flagged as bots — full overlap with sources 1+2. |
What makes source 2 special: those are our own WAF logs from live operations (artplants, inna-glas, showking and others) — not a secondary source but direct observation. ~390 hits/h; the crawler rotates: one IP, 5–6 multi-domain requests, then a switch within the /24.
Why the whole /24 — not a /32 list
- Full pool occupied: all 256 IPs answer ICMP, all belong to Wowrack by PTR, no third parties → a /24 block has no collateral.
- Rotation proven: SafeLine live showed IPs absent from any research list (
.198, .228, .230, .250) — a single-/32 list would be guaranteed incomplete. - Cleantalk confirms bot IPs we hadn’t seen ourselves — the pool is wider than our own telemetry.
- Operationally simple: one entry, no upkeep when IPs change within the subnet. About 10 % rotate actively at a time, the rest stands by in reserve.
Why other pools are NOT in the feed
Research surfaced further Wowrack subnets (208.115.111.0/24, 208.115.113.0/24) and 75 scattered AWS /24. They are deliberately out:
- Zero live hits in our SafeLine telemetry from these ranges.
208.115.xare mixed pools with real third-party customers (245 and 66 customer PTRs respectively, including mail gateways) — a /24 block there would be dangerous collateral.- AWS matches are scattered third-party mentions without our own confirmation; Cleantalk reports zero current activity there.
If one of these IPs shows up in the WAF in future, we extend the feed — until then it stays limited to the proven, clean /24.
User-agent & behaviour
Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)
Robots token: DotBot. Usually enters via /robots.txt; officially “robots.txt compliant”, in practice mixed reports. As a second layer to the IP block, a user-agent block on DotBot/ works well (e.g. in SafeLine).