Verification

Verified, not just self-declared.

A user-agent string is just text: anyone can claim to be GPTBot. Lume checks the agents that actually sign or publish their ranges (via signatures, reverse DNS, and published IP ranges), confirms which are genuinely who they say, and flags the rest as unverified. Stop trusting a spoofable string for the agents that matter.

1 line is all it takes to fake a user-agent claiming to be ChatGPT’s crawler. The user-agent is just text, so we don’t trust it.

Three ways Lume proves who an agent is

Standard-neutral and multi-signal: Lume verifies signatures where present, and falls back to reverse DNS and published IP ranges everywhere else. One verdict per request. This proves who an agent is (not that it’s harmless), and it works because the agents that matter (Googlebot, GPTBot, ClaudeBot) do sign or publish ranges. We don’t gatekeep who’s allowed; we tell you who’s authentic, and flag the rest for you to judge on behavior.

HTTP Message Signatures

Web Bot Auth · RFC 9421 · Ed25519

Agents sign each request with a private key. Lume checks the signature against the operator’s published key directory: cryptographic proof of identity, where the operator supports it.

Forward-confirmed reverse DNS

FCrDNS

Resolve the request IP’s hostname, then resolve that hostname back to an IP and confirm it matches. Proves the request came from the operator’s own infrastructure.

Published IP ranges

Kept fresh automatically

Match the request IP against the operator’s officially published address ranges. Lume keeps these ranges synced, so a rotation is picked up rather than silently breaking a verdict.

The 7 operators Lume verifies today

Verified vs. self-declared. Know which is which.

Operator Agent type Verification method Status
Google Search engine Published IP ranges · Forward-confirmed reverse DNS Verified
Microsoft Bing Search engine Published IP ranges · Forward-confirmed reverse DNS Verified
OpenAI AI crawler / agent HTTP Message Signatures (Web Bot Auth) · Published IP ranges Verified
Anthropic AI crawler / agent HTTP Message Signatures (Web Bot Auth) · Published IP ranges Verified
Perplexity AI answer engine Published IP ranges Verified
Amazon Crawler Published IP ranges · Forward-confirmed reverse DNS Verified
Apple Search engine Published IP ranges · Forward-confirmed reverse DNS Verified

Every other agent in the catalog is classified by user-agent and network signals and labeled honestly. Lume never marks an agent verified unless it can prove it.

What “verified” means in your dashboard

Every request carries a verdict. Declared identity is what the request claims; verified is what Lume could prove.

GPTBot/1.2 · signature valid · OpenAI key directory Verified
GPTBot/1.2 · from 203.0.113.9 · not in OpenAI ranges Unverified · spoofed

Stop trusting the user-agent string.

See which agents are genuinely who they claim on your site. Free plan, one ingest token, set up in minutes.

Start for free →