Honestly, doing the same, I would love to know what the true count is.

I quickly looked over my access logs just now (eyeballs and grep, not goaccess) and see a couple of patterns...

One, there are indeed lots of bots - over a thousand hits from Claude. Some from search, some from users.

There are some bots I've never even heard of (mj12bot?).

There are some things which look like legitimate traffic coming from a common household Web browser, looking at blog posts and such, until suddenly they make a 404 request for a nonexistent API endpoint and go away.

And there are _so many_ requests for `.env` files, `swagger.json`, `backup.sql`, `phpinfo.php`, WordPress (always!)... Sorry folks, it's nginx in a container, serving a bunch of static content.

Unless you run full behaviour analysis, it's going to be hard to identify all bots from a normal access log. If you want more data, you can add JA4 hash to your logs that will surface huge amounts of things pretending to be the latest chrome.