If there are a large number of LoRa devices, the targeting process becomes simpler.
LoRa is typically used in applications requiring long-range, low-power transmission.
If there are a large number of concurrent transmissions, it's highly likely that such scenarios exist.
For example, manual payment and collection for public parking spaces; smart utility poles; regular transmission of electricity meter readings (typically using GSM).
So, simply find similar transmission scenarios and a large number of similar items: equipment boxes, short antennas, waterproof boxes, etc.
Then, I tried the "wait for a rabbit at the tree" approach.
However, the measurements are usually not very useful. They typically refer to urban public facilities.
It's impossible to change the environment; you can only change yourself.
I suspect this is also one of the reasons why amateur radio in Zhejiang province is prohibited.