The list of network addresses Apple publishes for Applebot, the crawler behind Spotlight, Siri and Safari search, has grown by 21 network blocks covering 4,656 addresses. The change was flagged by a monitoring tool built by the London consultancy Merj and reported today by Search Engine Roundtable. Apple has published no announcement, no blog post and no explanation.

The addition is small in bytes and large in proportion. Before the update, the JSON file Apple maintains for crawler verification listed twelve network blocks. It now lists thirty-three. Nothing in the file explains the change, and nothing in Apple's support documentation refers to it.

What the published file now contains

Apple identifies Applebot traffic in two ways. The first is reverse DNS, where the requesting address resolves to a hostname inside the applebot.apple.com domain. The second is a match against a CIDR prefix listed in a JSON file Apple publishes and links from its "About Applebot" support page.

The version of that file examined for this article carries a creationTime value of July 31, 2026 at 10:00 and enumerates thirty-three IPv4 prefixes. Every one of them sits inside the 17.0.0.0 address space historically allocated to Apple.

Twelve of those prefixes were there before. Three are /27 blocks, at 17.241.208.160, 17.241.193.160 and 17.241.200.160. Nine are /24 blocks, spread across three separate neighbourhoods: 17.22.237.0, 17.22.245.0 and 17.22.253.0; 17.241.75.0, 17.241.219.0 and 17.241.227.0; and 17.246.15.0, 17.246.19.0 and 17.246.23.0.

The twenty-one new entries behave differently. All of them fall inside a single block, 17.166.0.0/16, and they arrive in tidy runs. Six consecutive /24 blocks span 17.166.20.0 to 17.166.25.0. Six more span 17.166.150.0 to 17.166.155.0. Another six span 17.166.232.0 to 17.166.237.0. Three /28 blocks complete the set, at 17.166.192.48, 17.166.240.48 and 17.166.248.48.

That structure matters more than it might appear. The earlier prefixes were scattered across three unrelated second-octet ranges, consistent with capacity accumulated over time in different facilities. The new ones read as a single allocation carved out in one pass.

The arithmetic behind the figure

A /24 block contains 256 addresses. Eighteen of them yield 4,608. A /28 block contains sixteen. Three of them yield forty-eight. The sum is 4,656, matching the total circulated publicly.

The pre-existing twelve prefixes account for a far smaller pool. Nine /24 blocks contribute 2,304 addresses and three /27 blocks contribute ninety-six, for a total of 2,400. Adding the new allocation takes the published pool to 7,056 addresses, an increase of 194 percent. Apple has not roughly doubled the addressing available to its crawler. It has almost tripled it.

Address count is not crawl capacity. A single machine can serve from many addresses, and many machines can share one. What the number does establish is intent to distribute requests across a much wider surface than before, which is the pattern operators use when parallel fetching is about to increase.

How the change surfaced

The change was not announced. It was detected.

Merj, an SEO and AEO consultancy based in the London area, runs a monitoring service that watches published crawler IP files for changes. Its alert, timestamped 00:49 and captured in a screenshot circulated on LinkedIn, lists the twenty-one added IPv4 ranges under the source label apple-applebot. The list in that alert matches the twenty-one prefixes in the JSON file exactly.

Ryan Siddle, who describes himself on LinkedIn as an SEO and AEO innovation partner and is associated with Merj, published the screenshot with a short assessment. "Wow! It looks like Apple might be entering the AI race with a new flavour of Applebot/Siri," he wrote. He put the scale in context against a rival: "We've seen on several occasions OpenAIramp up their IPs to warm the servers. The most recent was the Sol 5.6 release, but it wasn't at the scale Apple just did. Apple also hadn't updated their IPs for many years."

His closing line was speculative and labelled as such. "For anyone interested in AI Search, make sure Applebot can access your platform. I think something big might be about to happen..."

Two qualifications belong alongside that reading. Siddle's firm sells the monitoring product that produced the alert, which gives it a commercial interest in the visibility of crawler infrastructure changes. And the comparison to a prior OpenAI ramp rests on Merj's own historical observations rather than on any operator disclosure.

Search Engine Roundtable reported the change today, crediting Siddle's post and putting the figure at over 4,000 new addresses, with 4,656 as the precise count. A pseudonymous commenter on that report claimed a sharp rise in Applebot requests to their own site, describing roughly 4,000 visits the previous day and a comparable pace by midday, and said the traffic had been blocked. That account is a single unverified data point from an anonymous source and does not establish a pattern.

Timestamps that do not line up

Three dates attach to this story and they do not agree.

The JSON file carries a creationTime of July 31, 2026. The monitoring alert is timestamped 00:49 on the day it was published. The LinkedIn post carrying that alert displays a relative age of three days in the version captured for this article, while the Search Engine Roundtable report is dated August 17, 2026.

The creationTime discrepancy is the operationally significant one. Any site that keys change detection off the timestamp inside the file, rather than diffing the prefix list itself, would not register a recent revision. The field points at the end of July while the ranges surfaced in the middle of August.

Apple's file also carries no version number, no changelog and no differential. Contrast that with the daily refresh schedule Google adopted for its crawler IP files in March 2025, replacing a weekly cycle to narrow the window in which a stale allowlist can be exploited, a change PPC Land documented at the time. Siddle featured in that coverage too, noting that Merj had been storing crawler IP histories for Googlebot, Bingbot and OpenAI going back several years. The reason such archives exist is precisely that operators publish current state without publishing change.

A verification method with a documented gap

Apple's support page presents reverse DNS and CIDR matching as parallel routes to the same conclusion. They are not equivalent in coverage.

The documentation illustrates reverse DNS with a worked example, resolving the address 17.58.101.179 to the hostname 17-58-101-179.applebot.apple.com and back again. That address does not fall inside any of the thirty-three prefixes in the published file. Apple's own example of legitimate Applebot traffic would fail a strict CIDR check against Apple's own list.

The implication is narrow but concrete: the published prefix file is not an exhaustive inventory of addresses Applebot uses. Firewall rules, bot management configurations and log analysis pipelines built on the assumption that it is will misclassify traffic in both directions. Requests from unlisted Apple addresses read as impostors. And an allowlist frozen at twelve prefixes now misses two thirds of the advertised pool.

That failure mode is not hypothetical for the wider crawler landscape. Nothing in the HTTP protocol obliges a client to declare itself accurately, and PPC Land has catalogued the user agent strings major operators publish alongside the standing advice that string matching alone is insufficient for access decisions. Research covered in January 2026 found AI agents presenting spoofed user agent strings to bypass site defences, with one query to a chatbot triggering sixteen requests from twelve addresses impersonating human browsers.

What Applebot does with what it collects

The address expansion lands eleven weeks after Apple substantially rewrote what Applebot is for. The "About Applebot" page carries a published date of June 8, 2026, the same day Apple confirmed at WWDC26 that Siri AI runs on Google Gemini models. PPC Land covered the documentation rewrite two days later.

That document sets out three independent controls, and the independence is the point. Standard robots.txt directives govern whether Applebot crawls at all. Applebot-Extended, a secondary user agent that never fetches a page itself, governs whether crawled data trains Apple's foundation models. The nosnippet meta tag governs whether content is used as additional context when AI models generate output for Apple products, such as broad world knowledge answers in Siri and Search that may carry source links.

Apple states the combined effect plainly. Even with Applebot-Extended disallowed and content tagged nosnippet, site instructions may still permit Applebot to crawl, and the content remains discoverable through Spotlight, Siri, Safari and other system-wide features. Opting out of training is not opting out of the index.

Several operational details in the same document bear on how the new capacity will be felt. Applebot does not follow crawl-delay. Where robots.txt says nothing about Applebot but does address Googlebot, Applebot follows the Googlebot instructions, which means a large share of sites are governing Apple's crawler through rules written for someone else. Apple states that crawl rate adjusts automatically when a site slows or returns errors, and that crawled content is cached to reduce repeat fetching.

Paywalled publishers get a page-level signal. Marking structured data with isAccessibleForFree set to false keeps a page eligible for search results while excluding its content from use as additional context in AI-generated output. Apple states that section-level markup using hasPart is not supported. Directives can also travel in an X-Robots-Tag HTTP response header, which extends control to PDFs and images where meta tags cannot reach.

For rendering, Apple notes that Applebot may execute pages in a browser and that blocking JavaScript, CSS or XHR resources through robots.txt can prevent proper rendering. On ranking, the company lists aggregated user engagement with search results, relevancy matching between query and page content, the number and quality of inbound links, approximate location signals and webpage design characteristics, while stating that no predetermined weighting applies among them.

Crawl economics and a September deadline

Applebot has been a comparatively modest presence in crawler measurement. Cloudflare data covering a two month window and reported in January 2026 found Googlebot accessing 14.87 times more unique URLs than Applebot. A tripling of published address space does not by itself change that ranking, but it removes an infrastructure constraint on changing it.

The wider context is a market where crawl volume has become a billing dispute. Cloudflare opened an attribution dashboard to Bot Management customers on July 1, 2026 showing crawl-to-referral ratios that ranged from 118 crawls per referral at the low end to nearly 50,000 at the high end. Research from Cloudflare and ETH Zurich published on April 2, 2026 argued that AI bot traffic is degrading cache performance for human visitors, with AI crawlers accounting for 4.2 percent of HTML requests across the network. Individual operators have reached their own conclusions: the founder of the donor research site PatronView blocked Amazon's crawler after measuring 117,000 daily page reads, and recorded Claude-SearchBot at 35,000 crawls per human referral before blocking it.

One date now collides with Apple's expansion. From September 15, 2026, Cloudflare will block crawlers classified as Training and Agent by default on advertising-carrying pages for new domains onboarding to its network, with multi-purpose crawlers judged by their most restrictive behaviour. Applebot is named explicitly alongside Googlebot and BingBot as a crawler that will be blocked for customers who have elected to block Training.

Apple's own documentation is what puts Applebot in that category. The June 8 page states that crawled data may be used to train foundation models, which is the definition of a multi-purpose crawler under Cloudflare's taxonomy. A crawler that gains address capacity in August and a default-block rule that arrives in September are pulling in opposite directions.

What this means for marketers and publishers

Search visibility inside Apple's ecosystem has never carried the measurement apparatus that surrounds Google. There is no Apple equivalent of Search Console, no query-level reporting, no impression counts. Server logs are the primary evidence available, and server logs depend on correct crawler identification. An expansion of this size changes what those logs show and how they are read.

The commercial stakes attach to what Applebot now feeds. Content crawled by Applebot can surface in Spotlight, Siri and Safari suggestions, can be used as context for AI-generated answers, and, absent an Applebot-Extended disallow, can train the models behind Apple Intelligence. Each of those destinations sits further from a click-through than the last.

The trade-off has been measured elsewhere. Research from Rutgers Business School and The Wharton School, revised in April 2026, found news publishers who blocked large language model crawlers through robots.txt lost roughly 7 percent of weekly traffic within six weeks. Blocking is not costless, and neither is admitting unlimited automated traffic to a site whose economics depend on human arrivals.

Compliance in the other direction is also uneven. TollBit measurement published on August 14, 2026 found roughly 15 percent of identified page-fetching agents in Europe reaching URLs their operators had been told to avoid. Guidance issued by IAB Australia on July 31, 2026 sorted every crawler into one of four verdicts and concluded that robots.txt is not a reliable control for live agents, while drawing the same distinction Apple's documentation makes between a control token such as Applebot-Extended and the crawler that honours it.

What Apple has not said

No statement accompanied the change. Apple has not described the purpose of the new ranges, has not indicated whether crawl volume will rise, and has not connected the allocation to any product. The support page lists applebot@apple.com as the contact address for questions and concerns, and carries no note of revision since June 8.

The Siri AI programme provides the obvious backdrop without confirming anything. Apple and Google announced on January 12, 2026 that Gemini models would form the foundation of the next generation of Apple Foundation Models, with enhanced Siri capabilities promised for later in the year. At WWDC26 on June 8, Apple confirmed the arrangementand stated that Siri AI would not ship on iPhone or iPad in the European Union at launch, citing the Digital Markets Act.

A crawler that has to supply fresh grounding data for an assistant answering open-ended questions needs a different fetch profile from one populating a suggestions index. That is a reasonable inference from the documentation and the allocation pattern. It is not a disclosure, and Apple has made none.

Timeline

Summary

Who: Apple, whose published Applebot IP CIDR file gained twenty-one prefixes; Ryan Siddle and the consultancy Merj, whose monitoring tool detected the change and whose LinkedIn post circulated it; Search Engine Roundtable, which reported it. The parties affected are publishers, SEO practitioners and marketing teams whose firewall rules, bot management configurations and log analysis pipelines rely on Apple's published address list.

What: Twenty-one new IPv4 prefixes, eighteen /24 blocks and three /28 blocks, adding 4,656 addresses to a pool that previously held 2,400 across twelve prefixes. The published total now stands at 7,056 addresses, an increase of 194 percent. All new prefixes fall inside 17.166.0.0/16, in three runs of six consecutive /24 blocks plus three /28 blocks. The file itself carries a creationTime of July 31, 2026, which does not match the detection timestamp.

When: The monitoring alert is timestamped 00:49 and Search Engine Roundtable published its report on August 17, 2026. Apple's underlying "About Applebot" documentation carries a published date of June 8, 2026. Cloudflare's default block for Training-classified crawlers on advertising pages takes effect on September 15, 2026 for new domains.

Where: Global. Applebot crawls the open web and feeds Spotlight, Siri, Safari and, per Apple's June 8 documentation, the foundation models behind Apple Intelligence, Services and Developer Tools. Siri AI is excluded from iPhone and iPad in the European Union at launch under the Digital Markets Act.

Why: Apple has given no reason. The scale of the allocation, its concentration in a single /16 block and its timing relative to the Siri AI programme have prompted speculation about an expansion in crawl activity, but no operator disclosure supports that reading. What is established is narrower and immediate: verification lists built on the previous twelve prefixes now cover roughly a third of the addresses Apple advertises, and Apple's own reverse DNS example in its documentation resolves to an address absent from the published file entirely.