// Illustrative; not run against live data. Microsoft Sentinel, W3CIISLog (IIS). Adapt the column names for other web, API gateway or WAF logs.
// Pages that show a booking without a login: one client reading many different booking references.
// A customer opens their own confirmation page a few times. A script walks through thousands.
let Since = ago(30d);
let ConfirmationPath = @"(?i)REPLACE_WITH_CONFIRMATION_PAGE_PATH";
let ReferenceInQuery = @"(?i)(?:id|booking|reservation|ref)=([A-Za-z0-9-]{4,})";
W3CIISLog
| where TimeGenerated > Since
| where csUriStem matches regex ConfirmationPath
| where csUserName == "-"
| extend Reference = coalesce(extract(ReferenceInQuery, 1, csUriQuery), extract(@"/([A-Za-z0-9-]{6,})/?$", 1, csUriStem))
| summarize Requests = count(), DistinctReferences = dcount(Reference), Agents = make_set(csUserAgent, 5),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, bin(TimeGenerated, 1h)
| where DistinctReferences > 20
| order by DistinctReferences desc
| take 500