Can’t I just check the user-agent?

No. The user-agent is self-asserted text that anyone can forge in one line, and a significant share of traffic claiming to be ChatGPT’s crawler is spoofed. Lume checks cryptographic and network signals instead of trusting the string.

How does Lume verify without storing my visitors’ IPs?

Verification runs at ingest time. The IP is used for the check, then truncated to a network prefix before anything is persisted. No full client IP is ever stored.

Which operators can Lume verify today?

The 7 with published keys or IP ranges: Google, Microsoft (Bing), OpenAI, Anthropic, Perplexity, Amazon, and Apple. Everything else is classified by user-agent and network signals and honestly labeled unverified, never falsely marked verified.

What about bots hiding behind residential IPs?

Right. A bad actor won’t sign or publish ranges, so verification alone won’t catch a determined stealth scraper. That’s the point of the split: the honest agents that matter get proven, and everything unverifiable is surfaced as exactly that, for you to judge on behavior and act on in your WAF. Verification proves identity; it was never a safety badge or a blocker.

Verification

Verified, not just self-declared.

A user-agent string is just text: anyone can claim to be GPTBot. Lume checks the agents that actually sign or publish their ranges (via signatures, reverse DNS, and published IP ranges), confirms which are genuinely who they say, and flags the rest as unverified. Stop trusting a spoofable string for the agents that matter.

1 line is all it takes to fake a user-agent claiming to be ChatGPT’s crawler. The user-agent is just text, so we don’t trust it.

Three ways Lume proves who an agent is

Standard-neutral and multi-signal: Lume verifies signatures where present, and falls back to reverse DNS and published IP ranges everywhere else. One verdict per request. This proves who an agent is (not that it’s harmless), and it works because the agents that matter (Googlebot, GPTBot, ClaudeBot) do sign or publish ranges. We don’t gatekeep who’s allowed; we tell you who’s authentic, and flag the rest for you to judge on behavior.

HTTP Message Signatures

Web Bot Auth · RFC 9421 · Ed25519

Agents sign each request with a private key. Lume checks the signature against the operator’s published key directory: cryptographic proof of identity, where the operator supports it.

Forward-confirmed reverse DNS

FCrDNS

Resolve the request IP’s hostname, then resolve that hostname back to an IP and confirm it matches. Proves the request came from the operator’s own infrastructure.

Published IP ranges

Kept fresh automatically

Match the request IP against the operator’s officially published address ranges. Lume keeps these ranges synced, so a rotation is picked up rather than silently breaking a verdict.

The 7 operators Lume verifies today

Verified vs. self-declared. Know which is which.

Operator Agent type Verification method Status

Google Search engine Published IP ranges · Forward-confirmed reverse DNS Verified

Microsoft Bing Search engine Published IP ranges · Forward-confirmed reverse DNS Verified

OpenAI AI crawler / agent HTTP Message Signatures (Web Bot Auth) · Published IP ranges Verified

Anthropic AI crawler / agent HTTP Message Signatures (Web Bot Auth) · Published IP ranges Verified

Perplexity AI answer engine Published IP ranges Verified

Amazon Crawler Published IP ranges · Forward-confirmed reverse DNS Verified

Apple Search engine Published IP ranges · Forward-confirmed reverse DNS Verified

Every other agent in the catalog is classified by user-agent and network signals and labeled honestly. Lume never marks an agent verified unless it can prove it.