Some web sites may perform log analysis to identify retrieval
    programs such as Wget by looking for statistically significant
    similarities in the time between requests. [...]

    A 2001 article in a publication devoted to development on a popular
    consumer platform provided code to perform this analysis on the
    fly.  Its author suggested blocking at the class C address level to
    ensure automated retrieval programs were blocked despite changing
    DHCP-supplied addresses.

if index(lowcase(agentstr), 'keynote') or
index(lowcase(agentstr), 'sureseeker') or
index(lowcase(agentstr), 'wget') or