Overview

Loamly tracks three different kinds of AI-related traffic:

AI Bots — Automated crawlers (ChatGPT-User, GPTBot, PerplexityBot) detected through RFC 9421 signatures or user agents
Human from AI — Real people who clicked a link from ChatGPT, Perplexity, or Claude (has referrer or UTM)
Likely from AI — People who copied a URL from an AI chat and pasted it into their browser (no referrer, behavioral signals only)

All three show up in Analytics and Attribution. Together they reveal your complete AI traffic — including the 70% that Google Analytics typically misses.

Two detection paths

Loamly detects AI traffic through two paths that run in parallel:

Path	What it captures	Signals used
Browser tracker	Human pageviews and sessions	Referrer, UTM parameters, user agent
Edge verifier	AI bot requests	RFC 9421 signatures, signature agent, user agent

The edge verifier is enabled via Loamly managed proxy or a CDN worker. See AI Visitor Verification for setup.

RFC 9421 verified bots

AI agents that support RFC 9421 send signed HTTP headers. When those headers are present and valid, Loamly marks the visit as a verified AI bot.

If the headers are missing, Loamly falls back to user agent detection. Those are still marked as AI bots, but they are not verified.

If you expected verification but saw Human from AI

This usually means the request did not include RFC 9421 signature headers. That can happen when a human clicks a link, or when an AI mode does not sign requests. Verification requires the edge verifier path.

Human from AI

“Human from AI” means a real person clicked a link from an AI product. Loamly detects this using referrers and UTM parameters likeutm_source=chatgpt.com.

These visitors are not bots. They are counted as AI traffic because the visit originated from an AI platform.

Likely from AI

"Likely from AI" means we detected behavioral patterns consistent with someone who:

Asked ChatGPT or Perplexity a question
Got an answer with a URL
Copied the URL and pasted it into their browser

This traffic has no referrer (appears as "Direct" in GA), but shows telltale signals:

Fast navigation — Lands on page within milliseconds (paste behavior)
No mouse movement initially — Starts reading immediately
Deep pages — Arrives at specific content pages, not homepage
Recent bot crawl — ChatGPT-User or Perplexity-User crawled the same page within 10 minutes

Why this matters

Google Analytics shows this as "Direct" traffic. You'd think people typed your URL from memory. Reality: They discovered you through AI, copied the link, and visited. Loamly catches this.

First-touch vs any-touch

Loamly uses first-touch for the visitor “Source” field, but uses any-touch for the “Human from AI” label.

Example:

Visit 1: Direct → Source is Direct
Visit 2: Click from ChatGPT → Human from AI becomes true

This is why you can see “Human from AI” and “Source: Direct” at the same time. The AI label is based on any touchpoint, not just the first one.

Why two visitors appear

It is common to see two visitors around the same time when testing AI traffic:

An AI agent fetches pages server-side (AI bot visitor).
A human clicks a link in ChatGPT/Claude (Human from AI visitor).

AI agents also rotate IPs and user agents. Loamly creates a deterministic AI visitor ID based on IP, user agent, and date. If those change, a new AI visitor appears.

Country detection

Country comes from CDN headers when available. If those are missing, a geo lookup is used as a fallback.

AI infrastructure often exits from a small set of regions. It is normal to see many AI bots in a single country even when your own traffic is elsewhere.

Data stored

Human visits: store a masked IP (not raw) and a two-letter country code.
AI bot visits: store country only. No raw IP is stored for edge-verified bot requests.

Loamly does not store request or response bodies. Only metadata needed for attribution and verification is saved.

FAQ

Is “Human from AI” counted as AI traffic?

Yes. Loamly counts AI-referred humans as AI traffic, even if AI was not the first touchpoint.

Why is the source “Direct” but the label says “Human from AI”?

Source is first-touch. The AI label is any-touch. If the AI visit came later, the source stays Direct while the AI label becomes true.

Why wasn’t my ChatGPT agent verified?

RFC 9421 verification requires signed headers. If a request does not include those headers, it will not be verified. This can happen in some modes or when a human clicks a link instead of the agent fetching it.

Why do AI bots look like they are all in one country?

AI platforms run from centralized infrastructure. The geo country is the data center location, not a human location.