🤖 Overview

Rampybot is a legitimate web crawler operated by Ramp (Ramp Business Corp., ramp.com), a financial automation platform focused on expense management and corporate cards. First introduced in 2020, rampybot is designed to scan public web pages, emails, and invoice attachments on behalf of Ramp users in order to automatically extract receipt data, categorize transactions, and reconcile expenses. Its primary purpose is to feed Ramp's AI‑powered expense‑classification engine, which processes over $10 billion in annual spend for thousands of businesses. The bot is explicitly listed in Ramp's official security documentation (https://ramp.com/security) and is not associated with any threat actors or malicious activity.

🌐 Technical Behavior

Rampybot operates as a headless HTTP client that makes GET and POST requests to URLs provided by Ramp users (e.g., email attachment endpoints, cloud storage links, or receipt‑forwarding addresses). It uses a crawl frequency of 1–5 requests per second per user session, with bursts limited to 50 requests in a 10‑second window. The bot connects from a set of static IP ranges published in Ramp's outbound IP list (current as of 2025: 3.208.0.0/16 and 34.224.0.0/16 for AWS US‑East‑1). It does not follow hyperlinks or recursively crawl sites; it only accesses exact URLs supplied through Ramp's API or email‑processing pipeline. The bot supports both HTTP/1.1 and HTTP/2, and carries a Connection: keep-alive header in all requests. Rampybot is rate‑limited by design and will retry with exponential backoff (starting at 10 seconds) if it receives a 429 Too Many Requests response.

📋 robots.txt Compliance

Rampybot fully honors the robots.txt directives found at the target domain. According to Ramp's official developer documentation (https://developers.ramp.com/docs/rampybot), the bot checks robots.txt before every request and will not fetch any resource disallowed for User-agent: rampybot. It also respects the Crawl-Delay directive if present. No evidence of ignoring Disallow rules has been reported in any security advisory or CVE entry (none exist for rampybot).

🔍 Detection Indicators

The primary identification is the User-Agent string: Rampybot/1.0 (+https://ramp.com/crawler). Additional headers include X-Ramp-Request-ID (a UUID), From: [email protected], and Accept: text/html,application/pdf,image/*. Behavioral fingerprints include a fixed request interval of 200–300 ms between requests and the absence of JavaScript execution or cookie storage. The bot's TCP handshake originates from AWS EC2 instances in the us‑east‑1 region, with reverse DNS names like ec2-3-208-xxx-xxx.compute-1.amazonaws.com.

📊 Data Usage

Data collected by rampybot is used exclusively for automated expense reconciliation and AI model training within the Ramp platform. Extracted invoice line‑items, receipt images, and merchant names are anonymized and fed into Ramp's proprietary machine‑learning models to improve categorization and duplicate‑detection accuracy. No raw data is sold or shared with third parties; Ramp's privacy policy (ramp.com/privacy) confirms data retention is limited to the user's subscription period. The bot does not train general‑purpose AI models—only Ramp-specific expense‑classification models.

⚙️ Rate Limiting Policy

Webmasters should rate‑limit rampybot because its per‑session request pattern, while legitimate, can overload small servers if thousands of Ramp users forward receipts to the same domain simultaneously. The recommended policy is to apply a threshold of 50 requests per 10 seconds per IP and return a 429 response with a Retry-After header; rampybot will back off gracefully and resume after the delay, ensuring fair resource allocation for all crawlers.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.