Identify every bot, crawler, and agent in your logs — and prove which are real
The user-agent is just a string: you can’t trust it, and the firewall rule you wrote last quarter rots the moment a range drifts or you add a CDN. Lume does the adjudication: it identifies every bot, crawler, and AI agent hitting your stack and verifies which are authentic (Web Bot Auth, reverse DNS, and published IP ranges) on any host, kept fresh so you never grep a log or hand-maintain an IP list.
Sound familiar?
- There’s an unknown user agent all over my access logs. Who is this, and what does it want?
- AI crawlers and scrapers are hammering the origin and I’m the one eating the bandwidth.
- The UA says Googlebot but the IP isn’t Google’s. Half of these bots could be spoofed.
- I could forward-confirm reverse DNS and diff published IP ranges myself, but that’s an infra project I don’t want to own, and it rots the day a range drifts or I add another CDN.
What Lume does for you
Every bot, crawler, and agent: identified
Match every request against the live catalog: 56 cataloged bots, crawlers, and AI agents across 36 operators. Unknown user agents become named (operator, type, and robots token) and told apart from the humans in the same logs, so you segment every visitor type in one place, not just chase bots.
Verification, maintained for you
Web Bot Auth (RFC 9421, Ed25519), forward-confirmed reverse DNS, and published IP ranges, run for every supported operator and kept fresh. You read one verdict instead of maintaining IP lists and DNS lookups.
Verify in your own code
The Identification API takes a request’s headers and returns its operator, type, and whether it’s verified, so you can gate, route, or log any bot, crawler, or agent however you like.
Drop in, no app rewrite
Start from your edge or CDN logs with zero client JS and zero added latency: Lume reads requests you already emit. Prefer code? A dependency-free TypeScript SDK or a plain REST endpoint. No full client IP is ever stored; tokens are hashed.
Fits the way you ship
One ingest token and you’re live. Report traffic from the SDK, a REST call, or a no-code edge or CDN path, whatever fits your stack.
Engineer FAQ
Does this add latency to my requests?
It doesn’t have to touch your request path at all: the edge/CDN log path adds zero client JS and zero latency, reading requests you already emit. If you use the SDK, it batches events out of band, so tracking never sits inline. And when you want a synchronous verdict, the Identification API is cache-backed for low latency.
How do I verify a bot or crawler without building it myself?
Lume runs forward-confirmed reverse DNS, published IP ranges, and (where the operator signs) Web Bot Auth, and keeps the operator feeds updated. Verification is live for 7 operators today. You read one verdict instead of owning the lookups.
Can I gate or route bots and agents in my own code?
Yes. The Identification API (Starter and up) returns each request’s operator, type, and verified status, so your app decides what to allow, route, throttle, or log. Lume gives you the truth; the action is yours.
Do I have to change my application?
No. Use the dependency-free SDK, a single REST call, or a no-code path: Cloudflare Worker, Vercel middleware, WordPress, or your existing CDN logs.
Do you store my visitors’ IPs?
Never a full one. The IP is used at ingest to verify and classify, then truncated to a network prefix (/24 or /48) before anything is persisted.
Send your first event in a minute.
Free plan, one ingest token, dependency-free SDK. See what’s really in your logs.
Start for free →