MonRedBot

MonRedBot is the name of the requests that mon.red, a website monitoring service, sends to check that a site or a server is available.

What it does

• It asks an address that its owner added to mon.red (or that somebody typed into the test form on our start page) for the page, and measures how fast and with what code it answers.
• It sends a few ping packets to a host, or tries to connect to a TCP port that its owner asked us to watch.
• It uses ports 80 and 443 for web requests. It does not log in, submit forms or read what is on the page except for a text the owner asked us to look for.
• Requests come from a few servers in different countries; how to recognise them is below.

How to recognise the requests

Every web request (HTTP and HTTPS) of a check carries this User-Agent header:

(MonRedBot/0.1; +https://mon.red/doc/bot)

The part after MonRedBot/ is the version and changes from time to time. Ping packets and TCP connection tests are not web requests and have no User-Agent: they can only be recognised by the address they come from.

Where the requests come from

All web requests, ping packets and port connections of the checks leave from these IP addresses and from no others:

• Loading the list…

Looking up the data of a domain (its DNS records, the registration date in RDAP / WHOIS) is not a request to your site: it goes to the public DNS and registry servers from our own servers.

The same list is a JSON file, https://mon.red/public/probesIps.json, for firewalls and allow-lists. The field ips is the list of addresses and updated_at is the time (UTC) when the set of addresses last changed. It does not change on every request, only when an address is added, removed or replaced, so you can read the file once a day and touch your rules only when this time moves.

{
  "updated_at": "2026-10-12T18:29:36Z",
  "user_agent": "(MonRedBot/0.1; +https://mon.red/doc/bot)",
  "ips": ["31.220.27.196", "92.243.84.240", "213.169.78.23"],
  "locations": [{ "code": "eu-nl-ams-1", "name": "EU-AMS-1", "city": "Amsterdam", "country": "NL", "ip": "31.220.27.196" }, …]
}

How often

An owner chooses the interval, from once a minute. The test on our start page is limited to a few checks per visitor per ten minutes.

If you want it to stop

If you see these requests in your logs and do not want them, write to team@mon.red with the address or the host name, and we will remove it from our checks.