Such a firewall could even have learned to block Linux user agents on its own. Similar to how some spam filters learn what email headers are associated with spammers. So if the firewall is seeing a lot of bad traffic with “X11; Linux” in their UA strings and little normal traffic with that in their UA strings then the firewall will take the presence of that as an indicator of possibly bad traffic.
Don't bots typically fake a windows/chrome user agent though? I guess there might be enough low effort bots that just throw up a default platform/curl user agent.
Narh, it's extremely common to see stuff like Firefox 34 for Linux trying to log into WordPress sites a few hundred times per hour. I guess it's old malware that lives on in hacked web sites that the owners abandoned.
any decent bot spoofs the UA string randomly to one of the top 10 most frequent UA strings. That's like a number 2 feature after the one the bot was built for.
I'm pretty sure they have integration tests to make sure that it doesn't block iOS devices. Not having those tests for common Linux browsers is... Apple.