lowkey regex is a good start, but u should also check for
navigator.webdriver
to catch headless browsers that spoof the user agent. ive seen plenty of "clean" sessions turn out to be automated scrapers that bypass basic string checks. if u dont filter those, ur
session duration metrics get completely skewed.