imsu.io bot

imsu.io is an uptime monitoring service. When an imsu.io user adds a monitor for a website, an API or a TCP port, our servers check it on a schedule and alert that user when it stops answering. This page describes those requests, so that site owners, firewalls and bot management services can recognize them.

• It requests only the URLs and ports that imsu.io users enter themselves, usually their own sites and servers.
• It is not a crawler. It doesn't follow links, discover pages, index content, render pages or run JavaScript, and its results are not used to train AI models.
• It doesn't fetch robots.txt. Like other uptime monitors, it acts on behalf of a user who asked for one specific URL to be watched, so crawling rules don't apply to it.
• Each monitor is checked at most every 5 minutes on the free plan, and never more often than every 10 seconds. A failed check is retried once within 30 seconds.

HTTP checks send this User-Agent header:

imsu.io-uptime-monitor/1.0 (+https://imsu.io)

The version number may change; match on imsu.io-uptime-monitor.

When an AI app asks an imsu.io user for access through OAuth, imsu.io fetches the app's published client metadata document once (and again when its cache expires). Those requests come from the same addresses and send:

imsu.io-oauth/1.0 (+https://imsu.io)

• HTTP checks: one GET or HEAD request to the URL the user entered, with no request body and no credentials. Redirects are followed (up to 5) unless the user turned that off. The request times out after 1 to 30 seconds (10 by default). For a keyword check, at most the first 1 MB of the response body is read; otherwise only the status line and headers.
• TCP port checks: a TCP connection to the host and port, closed as soon as it is open. No data is sent.
• Heartbeat monitors don't contact your servers: your own job sends a request to imsu.io.
• Private and internal addresses (such as 10.0.0.0/8, 192.168.0.0/16 and loopback) are never checked, including after a redirect or a DNS change.

Every check and every other request imsu.io makes comes from the addresses listed at:

https://imsu.io/api/meta/ips

The list is JSON, needs no sign-in, and may be fetched from any origin. Cache it for up to an hour, and fetch it again from time to time: addresses are added there before new servers start sending requests. Today it holds one IPv4 address and one IPv6 prefix:

{
  "ipv4": ["178.104.120.188/32"],
  "ipv6": ["2a01:4f8:1c18:c38f::/64"],
  "prefixes": [
    { "prefix": "178.104.120.188/32", "family": "ipv4", "service": "checks", "region": "europe" },
    { "prefix": "2a01:4f8:1c18:c38f::/64", "family": "ipv6", "service": "checks", "region": "europe" }
  ]
}

• ipv4 and ipv6 list the prefixes of each family in CIDR notation, for firewalls that take a plain list.
• prefixes lists them all, with what sends requests from each (service) and where those servers are (region).

To print the list for a firewall:

curl -s https://imsu.io/api/meta/ips | jq -r '.ipv4[], .ipv6[]'

The User-Agent header can be copied by anyone. A request is from imsu.io only if its source address is in one of the prefixes at https://imsu.io/api/meta/ips.

If a firewall, a WAF or a bot protection service blocks the checks, the user's monitor reports your site as down. To let them through, allow the addresses from the list, ideally together with the user agent. On Cloudflare, for example, add a WAF custom rule that skips the security features for requests whose source IP is in the list.

The checks come from an imsu.io user who added your site. If you don't want your site checked, block the addresses above or answer with an error; or write to [email protected] with the URL or host, and we will stop the monitors that check it. Write to the same address to report a problem with the bot.