What is BotSpotter?

Every day, thousands of AI bots crawl the internet. Some are collecting pages to train the next big model. Some are indexing the web for AI search answers. Some are fetching a page right now because a person just asked ChatGPT or Claude a question. Most websites never see any of it.

BotSpotter makes it visible. A network of volunteer websites and honeypots reports every bot visit here. We count them live, put them on the map, and give each bot a name that stays the same wherever it shows up — so Copper Heron #0042 is the same bot on your blog, on a news site, and on a server in Singapore. When a bot nobody has seen before appears on three independent sites, it gets discovered and named here first.

Three kinds of AI bot

• Training crawlers — bulk-read the web to train models (GPTBot, ClaudeBot, Bytespider, Common Crawl).
• AI search — index pages so an AI can answer with citations (OAI-SearchBot, PerplexityBot).
• AI agents — fetch a page on behalf of a live user, this second (ChatGPT-User, Claude-User).

Plus the unidentified ones: automation that hasn't announced itself. Those are the interesting ones. They get names too.

Why it matters

• If you run a website: find out which AI companies are reading your pages and how often — free, two-minute install, no code for Nginx/Apache. Add your site as a sensor and climb the leaderboard.
• If you're curious: watch the AI economy happen in real time. Which countries are crawled most? Whose bots are busiest? What showed up this week that didn't exist last week?
• If you write or research: a public, live, citable source on AI crawler activity that isn't owned by a single cloud provider.

Why do the bots have faces?

Every bot gets a robot avatar drawn from its fingerprint — the colour comes from its name (a Copper anything is copper), the face from the hash. No stock images, no AI art, nothing licensed from anyone: it's a few hundred lines of SVG, so the same bot has the same face forever, everywhere.

Run a bot? Claim it

Operators can claim their bot: prove control (make the bot fetch a one-time URL, or publish a token on its homepage), then give it a proper name, description and category. Claimed bots carry a ✓ and the generated name stays as an alias.

What we don't do

We don't store IP addresses or page contents, and we set no cookies. Human visits to this portal are recorded pseudonymously (a one-way hash, country/city, browser family, referring domain) so the owner can see how many real people come here and from where; see the privacy section. Bots are named by a hash, never exposed. The numbers here are visits seen by participating sites, not “the whole internet” — the more sensors join, the closer it gets.

Add your site as a sensor

A sensor tells BotSpotter which bots visit your site. It never sends page content, cookies, header values, or your human visitors — browsers are filtered out on your server before anything leaves it. Two clicks and one paste: sign in, prove the domain is yours, paste one snippet.

log botspotter {
    output net tcp/bs-vector:9000 { soft_start }
    format filter { wrap json
        fields { request>headers>Cookie delete
                 request>headers>Authorization delete } }
}

pip install botspotter-sensor

# FastAPI / Starlette
from botspotter_sensor import BotSpotterMiddleware
app.add_middleware(BotSpotterMiddleware, key="")

# Flask / any WSGI
from botspotter_sensor import wsgi_sensor
app.wsgi_app = wsgi_sensor(app.wsgi_app, key="")

# Django settings.py
MIDDLEWARE += ["botspotter_sensor.django.BotSpotterMiddleware"]
BOTSPOTTER_KEY = ""

{"events":[{"ua":"Mozilla/5.0 (compatible; GPTBot/1.2)",
            "headers":["host","user-agent","accept","accept-encoding"],
            "ip":"20.171.207.5","cf_country":"US","method":"GET","status":200,"path":"/robots.txt"}]}

<a href="https://botspotter.app/?s="><img src="https://botspotter.app/badge/.svg" alt="AI bots spotted here, by BotSpotter"></a>

Sensor Terms & Privacy

Plain-English summary first; the terms follow. Effective 25 Oct 2026; §5 (human visitors) and §5a (accounts) updated 26 Oct 2026. These apply to anyone who installs a BotSpotter sensor or uses the BotSpotter API. Just looking at the site? Only the Privacy section concerns you.

Summary

• You install the sensor on sites you own or are authorised to administer. You're responsible for what you install.
• The sensor sends us bot-request metadata only; we discard IP addresses on arrival and never store page content.
• The service is free, provided as-is, with no uptime or accuracy guarantees.
• Aggregated data we publish is open under CC BY 4.0. Your site id appears publicly on the leaderboard.
• Either side can stop at any time: remove the sensor, or we revoke the key.

1. Who we are

BotSpotter (“we”, “us”) is an independent, non-commercial project operated by Bhushan Ladde, California, USA. Contact: [email protected].

2. Your responsibilities as a sensor operator

• You confirm you own, or are authorised by the owner to administer, every site on which you install a sensor.
• You are responsible for complying with laws that apply to you and your site, including any obligation to disclose third-party processing in your own privacy policy. We supply the description in §5 for that purpose.
• You will not modify the sensor to send data beyond what is described in §5, send data about sites you don't control, or send fabricated traffic.
• You keep your sensor key confidential. Anything sent with your key is attributed to your site.

3. What we provide

A free service that receives bot-request metadata from sensors, classifies and names bots, and publishes aggregated statistics. We may change, suspend, or discontinue any part of it at any time. We may revoke a key at our discretion, including for suspected abuse or fabricated data.

4. The software

The sensor code and the BotSpotter platform are open source under the MIT License. The license governs the software; these terms govern the service.

5. Data: what the sensor sends and what we keep

Sent by the sensor, per request your server judges to be automated: the names (not values) of the request headers in order; the User-Agent string; the client IP address; the CF-IPCountry header if present; HTTP method and status code; the timestamp; and a flag for whether the path was robots.txt. Requests that look like ordinary browsers are filtered on your server and not sent. No page content, cookies, header values, query strings, form data, or other paths are sent.

Processed on arrival and then discarded: the IP address. We use it in memory to derive (a) a country and approximate region, and (b) for unidentified bots only, a coarse network prefix (/16, up to 65,536 addresses) that becomes part of the bot's fingerprint hash. The address itself is never written to disk, logs, or backups.

Stored: timestamp, your site id, the bot's fingerprint hash and derived name, a version-stripped User-Agent family, bot operator and category, country, region, a coarse geohash, and the robots.txt flag. Raw events are kept 90 days; hourly aggregates indefinitely.

Human visitors to this portal: we do not store your IP address and we set no cookie or browser identifier. Each page view is recorded as a pseudonymous visit: a salted hash of your IP and browser (the hash cannot be turned back into either; the salt is a server secret), the country and, when our CDN supplies it, the city; the page viewed; the referring domain (e.g. linkedin.com, “direct”) — never the referring page; your browser family, operating system, device class and preferred language. These rows are kept for up to three years, are visible only to the site owner, are used solely to understand and demonstrate the site’s audience (how many people, from where, how often they return), and are never sold or shared individually. Public pages show aggregates only. A daily-rotating hash additionally powers the public “humans today / this week” counters. We may also use Cloudflare Web Analytics, a cookie-free, privacy-preserving service of our CDN, for the same purpose.

Legal basis (where GDPR/UK GDPR applies): legitimate interest in measuring automated traffic and in understanding the portal’s own audience. The IP address is processed transiently for seconds and never retained; what is retained is pseudonymous and coarse by design. If you believe a stored record identifies you, email us and we will remove it.

5a. Accounts (self-serve enrollment)

To add a site yourself you sign in with GitHub. We store your GitHub numeric id, login and avatar URL, the domains you enrol, when they were verified and a hash of each sensor key — nothing else, and no e-mail address. A key is issued only after you prove control of the domain (a DNS TXT record or a file under /.well-known/); we check that proof once, at verification. Signing out deletes nothing; removing a site revokes its key immediately and deletes the enrolment record. Statistics already published remain, as described in §6. To delete your account entirely, email us from the address on your GitHub profile.

6. Published data and your site id

Your site id (the name you choose when requesting a key) appears publicly on the sensor leaderboard with its hit counts. Choose a name you're comfortable publishing. Aggregated statistics and bot profiles we publish are licensed under CC BY 4.0; attribute “BotSpotter”.

7. No warranty

The service and data are provided “as is” and “as available”, without warranties of any kind, express or implied, including accuracy, completeness, merchantability, fitness for a particular purpose, or uninterrupted operation. Bot classification is heuristic and may be wrong. Do not use BotSpotter as the sole basis for blocking, billing, or legal decisions.

8. Limitation of liability

To the fullest extent permitted by law, we are not liable for any indirect, incidental, consequential, special, or punitive damages, or for lost profits, data, or goodwill, arising from the service or sensor, even if advised of the possibility. Our total liability for any claim is limited to USD 100 or the amount you paid us (zero), whichever is greater.

9. Indemnity

You will defend and hold us harmless from claims arising from your installation or use of a sensor on a site you were not authorised to administer, your breach of these terms, or your violation of applicable law.

10. Termination

You may stop at any time by removing the sensor. We may revoke keys or remove site ids at any time. Sections 5–11 survive termination. Historical aggregates already published remain published.

11. Governing law and changes

These terms are governed by the laws of the State of California, USA, without regard to conflict-of-law rules; courts in Sacramento County, California have exclusive jurisdiction. We may update these terms; material changes will be dated here and announced on the site. Continued use after a change is acceptance.

12. Claiming a bot

A bot may be claimed by its operator after verification (a fetch challenge the bot itself answers, or a token published on the bot's homepage domain). We store the contact email you give us as a salted hash once verified, plus the public fields you set (name, description, homepage, operator, category). You warrant that you operate the bot and that the information is accurate. Names must not impersonate others, mislead about the operator, or be offensive; we may edit or revoke a claim, and will do so on a substantiated dispute sent to [email protected]. The generated name remains a permanent public alias. The owner key is shown once; we cannot recover it, but you can re-verify to obtain a new one.

← add your site  ·  live counter

Claim your bot

Run a crawler or an agent that shows up here? Prove it's yours and you can give it a proper name, a description, a homepage and the right category. The generated name stays as a permanent alias so old links keep working. Claiming is free.

1 · Which bot?

Already verified?

Open /claim?slug=<your-bot> and paste your owner key: Manage

Abuse, impersonation or misleading names get the claim revoked (Terms §12). To dispute a claim, email [email protected].

Audience

Who is watching BotSpotter: real humans, counted without cookies (see privacy). Public, so the numbers can be checked by anyone; download as CSV · JSON.

Daily unique humans · last 90 days

Day by day

Method: a visitor is one unique per UTC day (salted hash of IP + browser, HyperLogLog ±1%); "all time" uses a date-free hash so returning visitors count once. Bots are excluded by User-Agent/header heuristics and never count as humans. Daily aggregates are public and retained three years; the per-visit detail behind them (pseudonymous, no IP) is visible to the site owner only.

Audience ledger

Owner view. One row per individual visitor: pseudonymous id (salted hash — no IP is stored anywhere), where from, device, how they arrived, how often they came back. Not linked from the site; robots.txt disallows it.