How do you spot bots that pretend to be human visitors?
Answer
By behaviour, because the user agent is worthless there: a current Chrome string, HTTP/2, a plausible language header, one page per IP address, thousands of addresses from cloud providers. Real browsers load images. Real visitors arrive from search and links and go to the same popular pages. A crowd that visits thousands of distinct pages, each exactly once, is not a crowd, it is a harvest. Hosting more than a hundred sites helps: a signature that shows up on many of them within one hour is not a person. Add honey pots, pages no human would ask for, and keep the classifier versioned, because the other side moves: one fleet answered a new rule within a day by fetching a single CSS file as an alibi.