You might be able to check the user agent to differentiate legitimate users from automated scanners?

There's always the chance that they use a browser's user agent to disguise themselves but that should be easy to check.