How I Built Loamly: Detecting AI Traffic That Google Analytics Misses
I'm Marco. I just launched Loamly after about a year of building.
The Problem
I use ChatGPT, Claude, and Perplexity for maybe half my research now.
Looking for a new tool? Ask ChatGPT. Comparing options? Claude. Need a recommendation? Perplexity.
I started wondering what happens on the other side. What do brands see when AI sends them traffic?
Nothing.
When someone finds your product through AI and visits your site, Google Analytics labels it as "direct traffic." No referrer. No UTM. Just... direct.
You have no idea where they came from.
What Loamly Does
Two things.
1. Brand Monitoring
See what AI platforms actually say when someone asks about your brand.
We run real queries against ChatGPT, Claude, Perplexity, and Gemini. You see the actual answers, tracked over time.
2. Traffic Detection
Know when AI sends visitors to your site. The traffic that GA calls "direct" but isn't.
How the Detection Works
The traffic detection is fully open source.
Loamly
Open-source AI traffic detection for websites
Know when ChatGPT, Claude, Perplexity, and Gemini visit your site.
Cryptographic verification. Zero false positives
Website • Documentation • Security • Community
The Problem
When users copy a URL from ChatGPT, Claude, or Perplexity:
- ❌ No referrer header (browser security blocks it)
- ❌ No UTM parameters (AI doesn't add them)
- ❌ Google Analytics shows "Direct Traffic"
This traffic is invisible. For many sites, it's 15-30% of visitors.
The Solution
Loamly detects AI traffic using RFC 9421 cryptographic signatures — the same standard used by OpenAI, Anthropic, and Google for their AI agents.
Detection Methods
Method
Accuracy
Description
RFC 9421 Signatures
100%
Cryptographic Ed25519 verification
Navigation Timing
65-78%
Paste vs click detection
Behavioral ML
75-90%
Mouse/scroll pattern classification
User-Agent
95%+
Known AI bot patterns
4-Tier Verification Architecture
Loamly offers multiple deployment options based on your needs:
Tier
Method
Accuracy
Deployment
1. Managed Proxy
ChatGPT Operator
Uses RFC 9421 HTTP Message Signatures. Cryptographically verified against OpenAI's public keys. 100% accurate, no false positives.
Claude, Perplexity, Gemini
Navigation timing patterns + behavioral fingerprinting. Different AI browsing agents have distinctive signatures in how they interact with pages.
Tech Stack
- Frontend: Next.js 15, React, Tailwind, shadcn/ui
- Backend: Supabase (Postgres + Auth + Edge Functions)
- Hosting: Vercel
- Emails: Resend
Why Open Source
I wanted developers to see exactly how the detection works. No black box.
You can self-host the traffic detection entirely. The brand monitoring runs on our side (needs API keys and scheduled jobs).
Attribution
The two parts work together.
Brand monitoring shows what AI is saying about you. Traffic detection shows when it actually sends you visitors.
Try It
Free tier: 5K credits/month, no card needed.
If something breaks or doesn't make sense, comment here or email me at marco.dicesare@loamly.ai.
I'll personally read everything and do my best to reply you and fix things :)
Top comments (0)