[_feus]

Usually these transactions are automated with the checkers. Some are as simple as a PHP script replaying a request, some are more sophisticated that use residential proxies, some are parts of huge enterprises like try2check. If you have a list of IPs, you can scan them for 80/443 open and sometimes catch simple checkers in action.