It's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux or something equally silly. In such cases it's easy to get a WAF to block the impossible combinations. The bots are usually simple enough that such simple measures block a large amount of the botnet traffic.

In our case, we block the impossible combos and rate-limit the ones commonly used by botnets.

Blocking based on whether the UA has "Linux" in it is just dumb, though.

I've seen Cloudflare block based on user-agent alone.

UA is a blocking mechanism in WAFs. Also, (Akamai or <web proxy> fix your shit), re-ordered HTTP headers do the same thing.

If you're behind a MITM web proxy at work, try going to Lowes.com - there's a chance you'll get blocked by their Akamai filter for putting headers back in the "wrong" (there is no wrong) way.

Much hyped "disruptive deep machine-learning smart AI" used for, i.e. fraud detection work the same way: by finding features commonly used by fraudsters and discriminating everyone having the same features (i.e. user agent, time of purchase, items purchased, even name on card).

Old-school non-computerized discrimination (i.e. racism) work exactly the same way.

Yes, it’s possible. Not out of the box usually, but someone probably added a custom rule.

Especially if you’re facing an attack from a common UserAgent with all the other variables changing. And the admin likely thought “Linux users don’t use this service.”

> Blocking by user agent would be a terrible idea.

You know what else is a terrible idea? Blocking IP ports in firewalls, or MAC based filtering, yet both of these are ubiquitous practices. Don't think something is not happening because you think is a bad idea. Other people, usually the ones in charge will often disagree.

Blocking user agents does not provide security, but it does increase the cost of attack which is perfectly acceptable as a part of a larger defence strategy.

It's like moving SSH to another port -- it won't stop anyone who knows what they're doing, but the majority of the bots that blindly connect to port 22 on every single host that has it open will be stopped by it.

If I were a criminal and saw a "NO CRIMINALS PLZ" sign on the door of a house, I think I'd be far less likley to break in...

That houseowner has probably set boobytraps etc.