It's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux

It's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux or something equally silly. In such cases it's easy to get a WAF to block the impossible combinations. The bots are usually simple enough that such simple measures block a large amount of the botnet traffic. In our case, we block the impossible combos and rate-limit the ones commonly used by botnets. Blocking based on whether the UA has "Linux" in it is just dumb, though.