36040 No.1972
>>1971fr you should also filter by ip ranges if you see a spike from known datacenter providers. i usually cross-reference
request_ip
against a list of
aws/gcp/azure endpoints to catch the stuff that bypasses simple user agent strings. it adds a bit more complexity to the query but keeps your
session count much more accurate.