Semrush Bot — verified IP ranges, ASN verification and the Googlebot impersonation

Semrush is one of the largest SEO and backlink tools — and its crawler is among the most active commercial bots on the web. Here are the verified IP ranges (part of our PARC Security feed) and, more importantly: how to identify the bot reliably. Because Semrush has crawled with a forged Googlebot user-agent for years — so detection by user-agent alone is worthless.

semrush.json — view feed   Official Semrush bot page →

The verified ranges

A total of 1,539 IPs across 6 × /24 plus 3 individual /32:

85.208.96.0/24      185.170.167.0/24
85.208.97.0/24      185.191.171.0/24
85.208.98.0/24      46.229.173.66/32
85.208.99.0/24      46.229.173.67/32
                    46.229.173.68/32

We cross-checked the list against hosting, forum and abuse sources in over 40 languages (the official Semrush KB, AbuseIPDB, Netify, CleanTalk, plus Russian, Chinese, Korean and Bulgarian hosting forums). The result: not a single documented Semrush crawler IP fell outside these six /24 + three /32. The feed fully covers the ranges documented worldwide.

Documented sightings (selection) and how they map onto the feed:

Load impact

In hosting analyses (Bulgarian and Russian hosting forums among others), SemrushBot regularly shows up as a noticeable load — samples of ~42,000 requests in two hours per server, individual URLs hit hundreds of times over, ~500 MB RAM held permanently per vHost (after a block, usage drops to ~50 MB). Together with AhrefsBot up to 40 % of the request volume on affected vHosts. In Russian and Ukrainian hosting forums the bot has been described consistently over the years as a DDoS-like load (full site scans several times a week). Whether to allowlist or block Semrush is a deliberate decision.

Detection: never by user-agent, always by source IP

Semrush says so itself: “verification of their bots boils down to validation by ASN check, with the IP addresses needing to be in AS209366”. The reason is uncomfortable — Semrush has impersonated the Googlebot user-agent from its own IPs since at least 2019:

• 2019 — GitHub issue nginx-ultimate-bad-bot-blocker #328: SiteAudit IPs from 46.229.173.x with a Googlebot user-agent and PTR siteaudit.crawler.semrush.com.
• 2021 — John Mueller (Google), “Bots that impersonate Googlebot”.
• 2025-11-04 — op111.net live log: 85.208.98.228 crawling with a Googlebot user-agent, PTR 101.siteaudit.bot.semrush.com.

Consequence: never validate crawlers by user-agent alone. Always check the source IP against the ASN or against this feed.

ASN sources

• AS209366 — SEMrush CY LTD (RIPE): Semrush's own ASN, originates 5 of the /24 (85.208.96/97/99.0/24, 185.170.167.0/24, 185.191.171.0/24). BGP + RIPE + RPKI valid. Semrush rotates within the allocation and sets PTRs only on the currently active crawler IPs.
• AS396982 — Google LLC / GCP (ARIN): MOAS origin for 85.208.98.0/24. The RIPE route object is AS209366 (Semrush), the BGP announcement runs via Google Cloud — Semrush hosts this block on GCP.
• AS39572 — DataWeb Global Group B.V. (RIPE): long-standing NL hosting partner. The three /32 46.229.173.66/67/68 are bidirectionally FCrDNS-confirmed as siteaudit.bot.semrush.com and therefore listed individually in the feed — the rest of this allocation belongs to third-party hosting customers (see below).
• AS30161 — Semrush Inc. (ARIN, US subsidiary): allocated in 2020 but not propagated in the global BGP since December 2018 (0 originated prefixes) — a reserve / zombie ASN with no operational IPs. Listed for completeness; no blocking impact.

FCrDNS methodology and result

In addition to the ASN check, we scan all 1,536 IPs of the six /24 plus the 256 IPs in 46.229.173.0/24 via forward and reverse DNS (resolvers 8.8.8.8 and 1.1.1.1), suffix match *.bot.semrush.com with forward verification back to the original IP.

Distribution of active crawler PTRs:

The three PTR-empty /24 are ASN-allocated but without active crawler PTRs — reserve or outgoing NAT. They stay in the feed because Semrush rotates within the allocation.

User-agent tokens

Twelve known tokens: SemrushBot, SiteAuditBot, SemrushBot-BA, SemrushBot-SI, SemrushBot-SWA, SemrushBot-BM, SemrushBot-CT, SplitSignalBot, SemrushBot-OCOB, SemrushBot-FT, RyteBot, SemrushBot-ESI. SemrushBot-BM (Backlink Monitoring) correlates with the PTR sub-pool *.bm.bot.semrush.com from the FCrDNS scan above; SemrushBot-CT is the Content Marketing Toolkit.

Blockable via robots.txt (example: User-agent: SemrushBot → Disallow: /). Note that Semrush does not support crawl-delay. The version identifier in the user-agent has shifted over the years from SemrushBot/2~bl (until ~2021) to today’s SemrushBot/7~bl — both can still appear in older logs.

Historical ranges — deliberately NOT in the feed

46.229.160.0/20 and 192.243.48.0/20 (AS39572 DataWeb) were Semrush’s stealth crawler pool until 2019/2020 under the old rDNS suffix crawler.semrush.com. Today they are formally DataWeb hosting allocation with a mixed bag of third-party customers (affiliate tracking, adult, casino, DGA clusters) and only about 10 remaining Semrush service IPs. Blocking the entire /20 would be collateral damage — the three demonstrably active SiteAudit /32 are listed separately, the rest stays out.

Adobe acquisition

Adobe completed its acquisition of Semrush on 28 April 2026. Migrations toward Adobe infrastructure are possible in the medium term — we keep an eye on feed maintenance and revalidate regularly.

Sources

• Semrush Bot — official
• Semrush Site Audit troubleshooting
• BGP.he.net — AS209366 SEMrush CY LTD
• BGP.he.net — AS30161 Semrush Inc. (inactive)
• Jump.bg — bot load and protection (load data)
• BGP.he.net — 85.208.98.0/24 (MOAS)
• Netify — Semrush Bot crawler info
• GitHub #328 — Semrush as fake Googlebot (2019)
• John Mueller — Bots that impersonate Googlebot
• Adobe completes Semrush acquisition (April 2026)

← Back to PARC Security   Contact us