AI bot visits spotted across — sensors in — countries · — bots named so far · same bot, same name, forever
—
Every day, thousands of AI bots crawl the internet. Some are collecting pages to train the next big model. Some are indexing the web for AI search answers. Some are fetching a page right now because a person just asked ChatGPT or Claude a question. Most websites never see any of it.
BotSpotter makes it visible. A network of volunteer websites and honeypots reports every bot visit here. We count them live, put them on the map, and give each bot a name that stays the same wherever it shows up — so Copper Heron #0042 is the same bot on your blog, on a news site, and on a server in Singapore. When a bot nobody has seen before appears on three independent sites, it gets discovered and named here first.
Plus the unidentified ones: automation that hasn't announced itself. Those are the interesting ones. They get names too.
We don't store IP addresses, page contents, or anything about human visitors beyond a daily count. Bots are named by a hash, never exposed. Humans are counted without cookies. The numbers here are visits seen by participating sites, not “the whole internet” — the more sensors join, the closer it gets.
A sensor tells BotSpotter which bots visit your site. It never sends page content, cookies, header values, or your human visitors — browsers are filtered out on your server before anything leaves it. You get a public spot on the leaderboard and a private view of which AI companies read your pages.
Keys are issued by hand while we're in beta. Fill this in and you'll get a key by email, usually the same day.
Python app (FastAPI, Starlette, Flask, Django) — zero dependencies:
pip install botspotter-sensor # FastAPI / Starlette from botspotter_sensor import BotSpotterMiddleware app.add_middleware(BotSpotterMiddleware, key="YOUR_KEY") # Flask / any WSGI from botspotter_sensor import wsgi_sensor app.wsgi_app = wsgi_sensor(app.wsgi_app, key="YOUR_KEY") # Django settings.py MIDDLEWARE += ["botspotter_sensor.django.BotSpotterMiddleware"] BOTSPOTTER_KEY = "YOUR_KEY"
Nginx / Apache / Caddy — no code, via Vector: add our log format, point Vector at the log file, set BS_KEY. Config files and a step-by-step are in sensors/ of the repo.
Anything else — POST JSON batches to /v1/ingest with header X-BS-Key:
{"events":[{"ua":"Mozilla/5.0 (compatible; GPTBot/1.2)",
"headers":["host","user-agent","accept","accept-encoding"],
"ip":"20.171.207.5","cf_country":"US","method":"GET","status":200,"path":"/robots.txt"}]}
Within a few minutes your site appears under Sensors with most catches, and every bot it sees gets its name. Behind Cloudflare? Nothing extra to do.
Plain-English summary first; the terms follow. Effective 25 Oct 2026. These apply to anyone who installs a BotSpotter sensor or uses the BotSpotter API. Just looking at the site? Only the Privacy section concerns you.
BotSpotter (“we”, “us”) is an independent, non-commercial project operated by Bhushan Ladde, California, USA. Contact: [email protected].
A free service that receives bot-request metadata from sensors, classifies and names bots, and publishes aggregated statistics. We may change, suspend, or discontinue any part of it at any time. We may revoke a key at our discretion, including for suspected abuse or fabricated data.
The sensor code and the BotSpotter platform are open source under the MIT License. The license governs the software; these terms govern the service.
Sent by the sensor, per request your server judges to be automated: the names (not values) of the request headers in order; the User-Agent string; the client IP address; the CF-IPCountry header if present; HTTP method and status code; the timestamp; and a flag for whether the path was robots.txt. Requests that look like ordinary browsers are filtered on your server and not sent. No page content, cookies, header values, query strings, form data, or other paths are sent.
Processed on arrival and then discarded: the IP address. We use it in memory to derive (a) a country and approximate region, and (b) for unidentified bots only, a coarse network prefix (/16, up to 65,536 addresses) that becomes part of the bot's fingerprint hash. The address itself is never written to disk, logs, or backups.
Stored: timestamp, your site id, the bot's fingerprint hash and derived name, a version-stripped User-Agent family, bot operator and category, country, region, a coarse geohash, and the robots.txt flag. Raw events are kept 90 days; hourly aggregates indefinitely.
Human visitors to this portal: we count unique visitors using salted hashes of IP and User-Agent that are fed only into HyperLogLog counters (a probabilistic structure that cannot be reversed or enumerated). The daily hash includes the date and powers “today” and “this week”; a second hash without the date powers “all time” so a returning person is counted once. No per-visitor record is written anywhere. No cookies, no local storage identifiers, no third-party analytics scripts.
Legal basis (where GDPR/UK GDPR applies): legitimate interest in measuring automated traffic. We have designed the processing so that no personal data is retained; the IP address is processed transiently for seconds. If you believe a stored record identifies you, email us and we will remove it.
Your site id (the name you choose when requesting a key) appears publicly on the sensor leaderboard with its hit counts. Choose a name you're comfortable publishing. Aggregated statistics and bot profiles we publish are licensed under CC BY 4.0; attribute “BotSpotter”.
The service and data are provided “as is” and “as available”, without warranties of any kind, express or implied, including accuracy, completeness, merchantability, fitness for a particular purpose, or uninterrupted operation. Bot classification is heuristic and may be wrong. Do not use BotSpotter as the sole basis for blocking, billing, or legal decisions.
To the fullest extent permitted by law, we are not liable for any indirect, incidental, consequential, special, or punitive damages, or for lost profits, data, or goodwill, arising from the service or sensor, even if advised of the possibility. Our total liability for any claim is limited to USD 100 or the amount you paid us (zero), whichever is greater.
You will defend and hold us harmless from claims arising from your installation or use of a sensor on a site you were not authorised to administer, your breach of these terms, or your violation of applicable law.
You may stop at any time by removing the sensor. We may revoke keys or remove site ids at any time. Sections 5–11 survive termination. Historical aggregates already published remain published.
These terms are governed by the laws of the State of California, USA, without regard to conflict-of-law rules; courts in Sacramento County, California have exclusive jurisdiction. We may update these terms; material changes will be dated here and announced on the site. Continued use after a change is acceptance.