User-Agent blacklist:
# Know script library
python-requests/*
Apache-HttpClient/*
sqlmap/*
Go-http-client/*
Python-urllib/*
Python/*
libwww-perl/*
Java/*
WinHTTP
WinHttpRequest
# Known site analysis bots
Wappalyzer
# Non-standard beginnings
^-?$
"^\("
^\'
"^\ "
^\"
^-
^=
^\.$
^\\$
^\d
^MSIE
^Chrome
^Empty
^Firefox
^IE
^Internet\ Explorer
# Non-standard endings
Chrome$
Firefox$
# Repeating same stuff
compatible.*compatible
Gecko.*Gecko
Mozilla.*Mozilla
MSIE.*MSIE
# Way too short user agent strings
^Mozilla$
^Opera$
^Mozilla/\d\.\d$
^Mozilla\ compatible$
^Mozilla/\d\.\d\ \(compatible\)$
^Mozilla/\d\.\d\ \(compatible;\)$
# Fake mixtures of browsers
Firefox.*Netscape
Firefox.*Opera
MSIE.*Chrome/
MSIE.*Firefox
MSIE.*Edge/
MSIE.*rv:
Opera.*Trident/
# Letters instead of version numbers
Chrome/([a-z]|[A-Z])\.
Firefox/([a-z]|[A-Z])\.
Gecko/([a-z]|[A-Z])\.
^Mozilla/([a-z]|[A-Z])
MSIE\ ([a-z]|[A-Z])
Opera/([a-z]|[A-Z])\.
\ rv:([a-z]|[A-Z])\.
# Fake Windows strings and versions
Windows/
Windows\ ([0-2]|[4-8])
Windows\ NT\)
Windows\ NT\ 0
Windows\ NT\ 1\.
Windows\ NT\ ([2-3]|[7-9])
Windows\ NT\ 5\.([3-9])
Windows\ NT\ 6\.([4-9])
Windows\ NT\ 10\.([1-9])
Windows\ NT\ (1[1-9]|4[0-9]|5[0-9]|6[0-9])
# Invalid user agents
BUILDDATE
Unknown
User\ Agent
UserAgent
User-Agent
# Suspicious user agents
TO-Browser/TOB