De-noising raw web access logs: bots spoof browser UAs on public domains

When deriving visitor counts from CloudFront/Amplify access logs, a user-agent bot-filter is not enough once the domain is public — scanners hit the real host with genuine browser UAs and probe common paths (/about, /wp-login, /.well-known/*). Reliable heuristics that survive this: (1) filter by x-host-header to your real hostnames (drops hits to the bare CloudFront domain), (2) count a visit only as status 200/304 to a path that actually exists (drops 404 path-probes), (3) treat any client IP that requested ANY non-existent path as a scanner and drop all its hits. On a single static HTML page you still cannot separate a headless crawler that only GETs / from a human, so report unique-visitor as an upper bound and trust referrers/geography/page-mix as the real signal.