Overview

Loamly tracks two different kinds of AI-related traffic:

AI bots (agentic crawlers) detected through RFC 9421 signatures or known AI user agents.
Humans from AI (real people who clicked a link inside an AI product like ChatGPT or Claude).

Both types show up in Analytics and Attribution, and both contribute to AI traffic metrics.

Two detection paths

Loamly detects AI traffic through two paths that run in parallel:

Path	What it captures	Signals used
Browser tracker	Human pageviews and sessions	Referrer, UTM parameters, user agent
Edge verifier	AI bot requests	RFC 9421 signatures, signature agent, user agent

The edge verifier is enabled via Loamly managed proxy or a CDN worker. See AI Visitor Verification for setup.

RFC 9421 verified bots

AI agents that support RFC 9421 send signed HTTP headers. When those headers are present and valid, Loamly marks the visit as a verified AI bot.

If the headers are missing, Loamly falls back to user agent detection. Those are still marked as AI bots, but they are not verified.

If you expected verification but saw Human from AI

This usually means the request did not include RFC 9421 signature headers. That can happen when a human clicks a link, or when an AI mode does not sign requests. Verification requires the edge verifier path.

Human from AI

“Human from AI” means a real person clicked a link from an AI product. Loamly detects this using referrers and UTM parameters likeutm_source=chatgpt.com.

These visitors are not bots. They are counted as AI traffic because the visit originated from an AI surface.

First-touch vs any-touch

Loamly uses first-touch for the visitor “Source” field, but uses any-touch for the “Human from AI” label.

Example:

Visit 1: Direct → Source is Direct
Visit 2: Click from ChatGPT → Human from AI becomes true

This is why you can see “Human from AI” and “Source: Direct” at the same time. The AI label is based on any touchpoint, not just the first one.

Why two visitors appear

It is common to see two visitors around the same time when testing AI traffic:

An AI agent fetches pages server-side (AI bot visitor).
A human clicks a link in ChatGPT/Claude (Human from AI visitor).

AI agents also rotate IPs and user agents. Loamly creates a deterministic AI visitor ID based on IP, user agent, and date. If those change, a new AI visitor appears.

Country detection

Country comes from CDN headers when available. If those are missing, a geo lookup is used as a fallback.

AI infrastructure often exits from a small set of regions. It is normal to see many AI bots in a single country even when your own traffic is elsewhere.

Data stored

Human visits: store a masked IP (not raw) and a two-letter country code.
AI bot visits: store country only. No raw IP is stored for edge-verified bot requests.

Loamly does not store request or response bodies. Only metadata needed for attribution and verification is saved.

FAQ

Is “Human from AI” counted as AI traffic?

Yes. Loamly counts AI-referred humans as AI traffic, even if AI was not the first touchpoint.

Why is the source “Direct” but the label says “Human from AI”?

Source is first-touch. The AI label is any-touch. If the AI visit came later, the source stays Direct while the AI label becomes true.

Why wasn’t my ChatGPT agent verified?

RFC 9421 verification requires signed headers. If a request does not include those headers, it will not be verified. This can happen in some modes or when a human clicks a link instead of the agent fetching it.

Are the embedded keys still valid?

Loamly ships with embedded OpenAI public keys for RFC 9421 verification. When keys rotate, the edge verifier, proxy, and app need updates. If verification starts failing, check the AI Verification doc and update keys.

Why do AI bots look like they are all in one country?

AI platforms run from centralized infrastructure. The geo country is the data center location, not a human location.