Generated user-agent strings fool naive bot checks but fall short of real fingerprints

Every five minutes, a GitHub Actions workflow fires a Python script, generates a fresh batch of user-agent strings, and commits them to this repo. The cumulative store lives in data/ALL/all_user_agents.txt — a flat text file, one string per line, no headers, no JSON wrapping. The stats snapshot in that same folder records the exact count of unique entries and how many were added in the most recent run, so you can see the database growing in near-real time.

The generation is not random sampling from a fixed list. The script applies weighted probabilities so that popular browsers and recent version numbers appear more often than obscure ones, and it enforces platform constraints: Safari never shows up paired with Windows, Samsung Internet only appears alongside Android. The result is a corpus that skews toward plausible combinations rather than a combinatorial explosion of nonsense pairings. Coverage spans over 100 browsers and over 100 operating systems, organized into timestamped snapshot folders that are pruned after 24 hours by default — only the cumulative ALL/ directory grows indefinitely.

For agent-based web scraping or testing work, the appeal is obvious: fetch the raw URL, pick a random line, rotate on each request. The Python example in the README does exactly that in five lines using only the standard library. The bash equivalent is a single curl piped to shuf.

The honest question is what "generated" means here. These are not strings harvested from real browser traffic; they are strings assembled by a script according to weighted rules. That distinction matters for fingerprinting resistance. A server doing serious bot detection looks at far more than the user-agent header — TLS fingerprints, HTTP/2 settings frames, timing patterns. Rotating a generated string from this corpus will fool naive checks but won't help against anything deeper. The repo makes no claim otherwise, which is fair.

What it does deliver is a large, continuously refreshed, freely accessible corpus of structurally valid, platform-consistent user-agent strings with zero setup cost. For load testing, for populating test fixtures, for any scenario where you need variety without caring about deep authenticity, it is a practical tool. The 1,840 OS/browser combinations recorded in the stats snapshot gives a sense of the combinatorial breadth actually covered.