You saw OpenPing in your logs. Here is what it is.

OpenPing is an uptime monitor. Someone asked it to check that a website, an API or a server is up, and it sent a small request to find out. Every request it makes says who it is:

User-Agent: OpenPing/1.0 (+https://openping.ai/bot)

What it reads

Only what anyone on the internet can see. A check is one of these:

• a request for a page or an API address, to see the status, the speed and whether expected words are there
• a TLS handshake, to read the certificate’s expiry date
• a DNS lookup, a ping, or a connection to a port
• when someone pastes an address into the checker on our home page, a short look around: the home page, the sitemap, and well-known addresses such as /health, /openapi.json and /.well-known/agent-card.json

It does not sign in unless the owner of the monitor gave it a test account. It does not fill in forms, follow links across your site, or build an index. It keeps the timings, the status code and at most the first 2 KB of a response, with personal data removed.

It never calls private addresses: our probes refuse private, link-local and cloud-metadata ranges, and connect only to the address they looked up.

How often it calls

• On the free plan a monitor runs at most every 3 minutes; on paid plans at most every 30 seconds.
• Each run comes from one region. Two more regions retry at once only when a run fails, to confirm it.
• The no-account checker on our home page is limited to 10 checks an hour from one address.
• Planned: one cap on the total checks against a site however many accounts watch it, and proof of domain ownership before checks faster than once a minute.

Allow it

If a firewall or bot filter is turning our checks away, allow the user agent above, or allow our addresses. The list of addresses our probes call from is published as JSON:

https://app.openping.ai/probe-ips.json

Fetch it on a schedule rather than copying it once. Addresses change as we add regions.

Block it

You owe us no reason. Any of these works:

• Refuse requests whose user agent starts with OpenPing/.
• Refuse the addresses in the list above.
• Email hello@openping.ai with the host name and we will stop checks against it from our side.

A monitor that is blocked simply reports “down” to whoever set it up. It does not retry harder or change its user agent.

A request that says OpenPing but is not on the list

Anyone can type our name into a user agent. If a request claims to be OpenPing and its address is not in the published list, it is not our probe. The probe and the CLI are open source, so people also run the same checks from their own machines, and those come from their addresses, not ours.

Contact

Something looks wrong, or we are calling too often? Write to hello@openping.ai with the host name and a log line. A person reads it.