The ReportURI-JsAnalyser fetches JavaScript files referenced in CSP Integrity telemetry to build an archive of scripts identified by their cryptographic hash for our JavaScript Integrity Monitoring solution.

This archive allows site operators to look up the contents of a script by its cryptographic hash, making it easier to identify and investigate scripts that appear on their site.

• Identifies itself with the User-Agent string ReportURI-JsAnalyser/1.0 (+https://report-uri.com/bot)
• Only fetches URLs that appear in CSP Integrity telemetry received by Report URI
• Makes a single GET request per URL and does not follow links or crawl further pages
• Runs on our own schedule, in the background, at a low request rate

The ReportURI-ToolsChecker is what our free tools fetch with. When someone asks one of them to check a site — reading a security.txt file, or a security header — this is the agent that makes the request.

It is not a crawler. Every request exists because a person pressed a button a moment earlier, and it is worth knowing that blocking it does not protect you from anything: it only means visitors checking your site with our tools are told we could not reach you.

• Identifies itself with the User-Agent string ReportURI-ToolsChecker/1.0 (+https://report-uri.com/bot)
• Only fetches addresses a visitor has explicitly asked us to check
• Makes a small number of requests per check and does not crawl
• Sends nothing on its own schedule — no visitor, no traffic

The two bots run on different machines and do not share an outbound address, so each has its own list. Allow-listing every address below covers both; allow-listing one list lets through only that bot.

ReportURI-JsAnalyser

IP Address
138.197.200.179
206.189.217.46

ReportURI-ToolsChecker

IP Address
142.93.80.92
165.227.5.123
159.89.151.199
142.93.28.79
68.183.8.165

The tools list is longer because a tool check happens live, inside the request that asked for it, so it leaves from whichever of our web servers is serving you at the time — any of them can be the one that reaches your site.

A machine-readable list of IP addresses is available in plain text, JSON, and CSV formats. The plain text list is every address; the JSON and CSV also say which bot each address belongs to.

If you have questions or concerns about either bot, please contact us at bot@report-uri.com.