T184075 was an attempt in this regard. I have the result of that analysis somewhere.

In T234980#5557869, @Huji wrote:

T184075 was an attempt in this regard. I have the result of that analysis somewhere.

That would indeed be helpful to see. My first thought was that we can flag UAs which don't contain expected keywords (for example "Chrome" or "Webkit") but I guess if someone is spoofing a UA to evade a check, they would probably try and mimic a real-UA as much as possible, right?

@Ladsgroup Your thoughts on this ticket are also welcome!

For this, it seems doing it on flay and frontend make sense.

I'm pretty sure there are libraries that parse UA and tell you if it belongs to a human user or not. They are widely needed in routing and analytics. Varnish uses something (don't know what exactly) to fill webrequest fields like access_method, agent_type, and user_agent_map. Let me search for something like this for javascript (we can't use npm packages in production though 😢)

Here's two https://github.com/faisalman/ua-parser-js and https://www.npmjs.com/package/useragent the latter is node-based only though.

The tool https://en.wikipedia.org/wiki/User:GeneralNotability/InvestorGoat.js is able to parse and compare user agent strings.