Unless you run full behaviour analysis, it's going to be hard to identify all bots from a normal access log. If you want more data, you can add JA4 hash to your logs that will surface huge amounts of things pretending to be the latest chrome.

▲

pixl97 2 days ago | parent [-]

How long before bots just use the chrome crypto API to make connections?

	▲	ninjalanternshk 21 hours ago \| parent \| next [-]
		At scale it’s vastly more resource intensive than scripts, so it does stop the very cheapest layer of spammers, but not anyone in any way resourced or determined.
	▲	viraptor 2 days ago \| parent \| prev [-]
		They already can. But they largely don't. We still get lots of really dumb requests that don't do basic hiding.