Identify every bot, crawler, and agent in your logs — and prove which are real
The user-agent is just a string; you can’t trust it. Lume identifies every bot, crawler, and AI agent hitting your stack and verifies which are authentic, running Web Bot Auth, reverse DNS, and published IP ranges for every operator, so you don’t have to maintain any of it.
Sound familiar?
- There’s an unknown user agent all over my access logs. Who is this, and what does it want?
- AI crawlers and scrapers are hammering the origin and I’m the one eating the bandwidth.
- The UA says Googlebot but the IP isn’t Google’s. Half of these bots could be spoofed.
- I know I should forward-confirm reverse DNS and check published IP ranges, but that’s an infra project I don’t want to own.
What Lume does for you
Every bot, crawler, and agent: identified
Match every request against the live catalog: 56 cataloged bots, crawlers, and AI agents across 36 operators. Unknown user agents become named, with their operator, type, and robots token.
Verification, maintained for you
Web Bot Auth (RFC 9421, Ed25519), forward-confirmed reverse DNS, and published IP ranges, run for every supported operator and kept fresh. You read one verdict instead of maintaining IP lists and DNS lookups.
Verify in your own code
The Identification API takes a request’s headers and returns its operator, type, and whether it’s verified, so you can gate, route, or log any bot, crawler, or agent however you like.
Drop in, no app rewrite
A dependency-free TypeScript SDK, a plain REST endpoint, or a no-code edge/CDN path. No full client IP is ever stored; tokens are hashed.
Fits the way you ship
One ingest token and you’re live. Report traffic from the SDK, a REST call, or a no-code edge or CDN path, whatever fits your stack.
Engineer FAQ
Does this add latency to my requests?
No. The SDK batches events and sends them out of band, so tracking never sits in your request path. When you do want a synchronous verdict, the Identification API is cache-backed for low latency.
How do I verify a bot or crawler without building it myself?
Lume runs forward-confirmed reverse DNS, published IP ranges, and Web Bot Auth for every supported operator and keeps the feeds fresh. Verification is live for 7 operators today. You read one verdict instead of owning the lookups.
Can I gate or route bots and agents in my own code?
Yes. The Identification API (Solo and up) returns each request’s operator, type, and verified status, so your app decides what to allow, route, throttle, or log. Lume gives you the truth; the action is yours.
Do I have to change my application?
No. Use the dependency-free SDK, a single REST call, or a no-code path: Cloudflare Worker, Vercel middleware, WordPress, or your existing CDN logs.
Do you store my visitors’ IPs?
Never a full one. The IP is used at ingest to verify and classify, then truncated to a network prefix (/24 or /48) before anything is persisted.
Send your first event in a minute.
Free plan, one ingest token, dependency-free SDK. See what’s really in your logs.
Start for free →