Twitterbot / X crawler — IP ranges, ASN verification and the Grok AI-training risk
by shop owners for shop owners.
The IP ranges of the X / Twitter crawler (Twitterbot) to allowlist or block — plus why X publishes no official IP list, how to verify by ASN (AS-TWITTER), and why since the xAI acquisition Grok AI-training traffic can come from the same networks.
X (formerly Twitter) runs the Twitterbot for link previews (Twitter Cards) — and since the xAI acquisition (May 2025), the same networks likely also carry AI-training crawls for Grok. X publishes no official IP list; verification is solely by ASN. Here are the aggregated ranges (part of our PARC Security feed) and how we derived and validated them.
twitter-x.json — view feed X Cards docs →
The ranges
A total of 20 prefixes (17 IPv4 + 3 IPv6), aggregated from five X-owned ASNs:
8.25.194.0/23 192.44.68.0/23 199.96.56.0/21
8.25.196.0/23 192.48.236.0/23 202.160.128.0/22
64.63.0.0/18 192.133.76.0/22 209.237.192.0/19
69.12.56.0/21 199.16.156.0/22 2400:6680::/32
69.195.160.0/19 199.59.148.0/22 2606:1f80::/32
103.252.112.0/22 104.244.40.0/21 2a04:9d40::/29
185.45.4.0/22 188.64.224.0/21
We derived this list from ASN ownership (no official X list) and validated it against active Twitterbot pools via FCrDNS.
No official IP list — only ASN
X (and Twitter before it) publishes no crawler IP list. The X developer forum confirms it verbatim: “No accurate information on the IPs used by the Twitterbot Crawler.” That leaves ASN verification — and because X data can now flow into Grok, we deliberately put all prefixes of the X ASNs into the feed, not just the FCrDNS-active ones.
ASN constellation (AS-SET AS-TWITTER)
From the RADB AS-SET AS-TWITTER (maintainer MAINT-AS13414, maintained by arad@twitter.com):
- AS13414 — Twitter Inc.: US main backbone, the bulk of the prefixes.
- AS35995 — Twitter Inc.: US.
- AS54888 — Twitter Inc.: US.
- AS63179 — Twitter Inc.: US.
- AS63194 — Crashlytics, Inc.: US CDN (a Twitter subsidiary since 2017, mobile crash reporting).
After deduplication and CIDR aggregation, ~148 sub-allocations become 20 prefixes (86 % shorter).
Empirical validation
PTR sweep over the active Twitterbot /24 plus a cross-check of the IPs named in forums and the X dev forum:
| /24 | PTRs on *.twttr.com / *.x.com | Assessment |
|---|---|---|
199.59.148.0/24 | 244 / 256 | highly active Twitterbot pool |
199.59.149.0/24 | 253 / 256 | highly active Twitterbot pool |
199.59.150.0/24 | 197 / 256 | highly active Twitterbot pool |
199.16.156.0/24 | new *.x.com convention | active |
104.244.x · 64.63.x | mostly PTR-empty | backend workers without PTR |
199.59.156.0/24 | 0 | no longer Twitter (see below) |
Result: 16 of 17 known Twitterbot IPs are covered by the ASN-aggregated list. The single “gap” is deliberate: 199.59.156.x was named as a Twitterbot range in old X documentation but has belonged to SupportCloud LLC (AS53674) since 2024 — now a spam domain, correctly not in the feed.
PTR patterns
r-{ip-with-dashes}.twttr.com— old Twitter convention (199.59.148–150.0/22), FCrDNS-verifiable{name}.x.com— new X convention (e.g.spring-chicken-bo.x.com) for 199.16.156.0/22*.twttr.com/*.twimg.com— CDN endpoints- backend IPs (104.244.x, 64.63.x, 8.25.x) are PTR-empty — operational outgoing NAT with no public branding
The Grok angle
Since May 2025, X is formally a subsidiary of xAI Holdings. Grok (xAI’s LLM) is trained in part on web-crawl data. So the X-owned ASNs may carry AI-training traffic in addition to the classic Twitterbot — analogous to Meta-ExternalAgent. There is no officially documented Grok crawler user-agent (as of June 2026); any crawls likely run under Twitterbot or a browser user-agent from the same networks.
Consequence: if you only want Twitter Cards, you can allow Twitterbot by user-agent. If you want to exclude AI-training scraping, you have to block the X ASNs by IP — because a disguised Grok crawler can’t be reliably caught by user-agent alone. That is exactly what the full ASN list in the feed is for.