user_agent_parsers:

#### SPECIAL CASES TOP ####

# ESRI Server products

- regex: '(GeoEvent Server) (\d+)(?:\.(\d+)(?:\.(\d+)|)|)'

# ESRI ArcGIS Desktop Products

- regex: '(ArcGIS Pro)(?: (\d+)\.(\d+)\.([^ ]+)|)'

- regex: 'ArcGIS Client Using WinInet'

family_replacement: 'ArcMap'

- regex: '(OperationsDashboard)-(?:Windows)-(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Operations Dashboard for ArcGIS'

- regex: '(arcgisearth)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'ArcGIS Earth'

- regex: 'com.esri.(earth).phone/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'ArcGIS Earth'

# ESRI ArcGIS Mobile Products

- regex: '(arcgis-explorer)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Explorer for ArcGIS'

- regex: 'arcgis-(collector|aurora)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Collector for ArcGIS'

- regex: '(arcgis-workforce)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Workforce for ArcGIS'

- regex: '(Collector|Explorer|Workforce)-(?:Android|iOS)-(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: '$1 for ArcGIS'

- regex: '(Explorer|Collector)/(\d+) CFNetwork'

family_replacement: '$1 for ArcGIS'

# ESRI ArcGIS Runtimes

- regex: 'ArcGISRuntime-(Android|iOS|NET|Qt)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'ArcGIS Runtime SDK for $1'

- regex: 'ArcGIS\.?(iOS|Android|NET|Qt)(?:-|\.)(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'ArcGIS Runtime SDK for $1'

- regex: 'ArcGIS\.Runtime\.(Qt)\.(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'ArcGIS Runtime SDK for $1'

# CFNetwork Podcast catcher Applications

- regex: '^(Luminary)[Stage]+/(\d+) CFNetwork'

- regex: '(ESPN)[%20| ]+Radio/(\d+)\.(\d+)\.(\d+) CFNetwork'

- regex: '(Antenna)/(\d+) CFNetwork'

family_replacement: 'AntennaPod'

- regex: '(TopPodcasts)Pro/(\d+) CFNetwork'

- regex: '(MusicDownloader)Lite/(\d+)\.(\d+)\.(\d+) CFNetwork'

- regex: '^(.{0,200})-iPad\/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|) CFNetwork'

- regex: '^(.{0,200})-iPhone/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|) CFNetwork'

- regex: '^(.{0,200})/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|) CFNetwork'

# Podcast catchers

- regex: '^(Luminary)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

- regex: '(espn\.go)'

family_replacement: 'ESPN'

- regex: '(espnradio\.com)'

family_replacement: 'ESPN'

- regex: 'ESPN APP$'

family_replacement: 'ESPN'

- regex: '(audioboom\.com)'

family_replacement: 'AudioBoom'

- regex: ' (Rivo) RHYTHM'

# @note: iOS / OSX Applications

- regex: '(CFNetwork)(?:/(\d+)\.(\d+)(?:\.(\d+)|)|)'

family_replacement: 'CFNetwork'

# Pingdom

- regex: '(Pingdom\.com_bot_version_)(\d+)\.(\d+)'

family_replacement: 'PingdomBot'

# 'Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/534.34 (KHTML, like Gecko) PingdomTMS/0.8.5 Safari/534.34'

- regex: '(PingdomTMS)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'PingdomBot'

# 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/61.0.3163.100 Chrome/61.0.3163.100 Safari/537.36 PingdomPageSpeed/1.0 (pingbot/2.0; +http://www.pingdom.com/)'

- regex: '(PingdomPageSpeed)/(\d+)\.(\d+)'

family_replacement: 'PingdomBot'

# PTST / WebPageTest.org crawlers

- regex: ' (PTST)/(\d+)(?:\.(\d+)|)$'

family_replacement: 'WebPageTest.org bot'

# Datanyze.com spider

- regex: 'X11; (Datanyze); Linux'

# New Relic Pinger

- regex: '(NewRelicPinger)/(\d+)\.(\d+)'

family_replacement: 'NewRelicPingerBot'

# Dynatrace/Ruxit synthetic monitor

- regex: '(RuxitSynthetic)/(\d+)\.(\d+)'

family_replacement: 'Ruxit Synthetic'

# Tableau

- regex: '(Tableau)/(\d+)\.(\d+)'

family_replacement: 'Tableau'

# Adobe CreativeCloud

- regex: 'AppleWebKit/\d{1,10}\.\d{1,10}.{0,200} Safari.{0,200} (CreativeCloud)/(\d+)\.(\d+).(\d+)'

family_replacement: 'Adobe CreativeCloud'

# Salesforce

- regex: '(Salesforce)(?:.)\/(\d+)\.(\d?)'

#StatusCake

- regex: '(\(StatusCake\))'

family_replacement: 'StatusCakeBot'

# Facebook

- regex: '(facebookexternalhit)/(\d+)\.(\d+)'

family_replacement: 'FacebookBot'

# Google Plus

- regex: 'Google.{0,50}/\+/web/snippet'

family_replacement: 'GooglePlusBot'

# Gmail

- regex: 'via ggpht\.com GoogleImageProxy'

family_replacement: 'GmailImageProxy'

# Yahoo

- regex: 'YahooMailProxy; https://help\.yahoo\.com/kb/yahoo-mail-proxy-SLN28749\.html'

family_replacement: 'YahooMailProxy'

# Twitter

- regex: '(Twitterbot)/(\d+)\.(\d+)'

family_replacement: 'Twitterbot'

# Bots Pattern 'name/0.0.0'

- regex: '/((?:Ant-|)Nutch|[A-z]+[Bb]ot|[A-z]+[Ss]pider|Axtaris|fetchurl|Isara|ShopSalad|Tailsweep)[ \-](\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

# Bots Pattern 'name/0.0.0'

- regex: '\b(008|Altresium|Argus|BaiduMobaider|BoardReader|DNSGroup|DataparkSearch|EDI|Goodzer|Grub|INGRID|Infohelfer|LinkedInBot|LOOQ|Nutch|OgScrper|Pandora|PathDefender|Peew|PostPost|Steeler|Twitterbot|VSE|WebCrunch|WebZIP|Y!J-BR[A-Z]|YahooSeeker|envolk|sproose|wminer)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

# MSIECrawler

- regex: '(MSIE) (\d+)\.(\d+)([a-z]\d|[a-z]|);.{0,200} MSIECrawler'

family_replacement: 'MSIECrawler'

# DAVdroid

- regex: '(DAVdroid)/(\d+)\.(\d+)(?:\.(\d+)|)'

# Downloader ...

- regex: '(Google-HTTP-Java-Client|Apache-HttpClient|PostmanRuntime|Go-http-client|scalaj-http|http%20client|Python-urllib|HttpMonitor|TLSProber|WinHTTP|JNLP|okhttp|aihttp|reqwest|axios|unirest-(?:java|python|ruby|nodejs|php|net))(?:[ /](\d+)(?:\.(\d+)|)(?:\.(\d+)|)|)'

# Pinterestbot

- regex: '(Pinterest(?:bot|))/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)[;\s(]+\+https://www.pinterest.com/bot.html'

family_replacement: 'Pinterestbot'

# Bots

- regex: '(CSimpleSpider|Cityreview Robot|CrawlDaddy|CrawlFire|Finderbots|Index crawler|Job Roboter|KiwiStatus Spider|Lijit Crawler|QuerySeekerSpider|ScollSpider|Trends Crawler|USyd-NLP-Spider|SiteCat Webbot|BotName\/\$BotVersion|123metaspider-Bot|1470\.net crawler|50\.nu|8bo Crawler Bot|Aboundex|Accoona-[A-z]{1,30}-Agent|AdsBot-Google(?:-[a-z]{1,30}|)|altavista|AppEngine-Google|archive.{0,30}\.org_bot|archiver|Ask Jeeves|[Bb]ai[Dd]u[Ss]pider(?:-[A-Za-z]{1,30})(?:-[A-Za-z]{1,30}|)|bingbot|BingPreview|blitzbot|BlogBridge|Bloglovin|BoardReader Blog Indexer|BoardReader Favicon Fetcher|boitho.com-dc|BotSeer|BUbiNG|\b\w{0,30}favicon\w{0,30}\b|\bYeti(?:-[a-z]{1,30}|)|Catchpoint(?: bot|)|[Cc]harlotte|Checklinks|clumboot|Comodo HTTP\(S\) Crawler|Comodo-Webinspector-Crawler|ConveraCrawler|CRAWL-E|CrawlConvera|Daumoa(?:-feedfetcher|)|Feed Seeker Bot|Feedbin|findlinks|Flamingo_SearchEngine|FollowSite Bot|furlbot|Genieo|gigabot|GomezAgent|gonzo1|(?:[a-zA-Z]{1,30}-|)Googlebot(?:-[a-zA-Z]{1,30}|)|GoogleOther|Google SketchUp|grub-client|gsa-crawler|heritrix|HiddenMarket|holmes|HooWWWer|htdig|ia_archiver|ICC-Crawler|Icarus6j|ichiro(?:/mobile|)|IconSurf|IlTrovatore(?:-Setaccio|)|InfuzApp|Innovazion Crawler|InternetArchive|IP2[a-z]{1,30}Bot|jbot\b|KaloogaBot|Kraken|Kurzor|larbin|LEIA|LesnikBot|Linguee Bot|LinkAider|LinkedInBot|Lite Bot|Llaut|lycos|Mail\.RU_Bot|masscan|masidani_bot|Mediapartners-Google|Microsoft .{0,30} Bot|mogimogi|mozDex|MJ12bot|msnbot(?:-media {0,2}|)|msrbot|Mtps Feed Aggregation System|netresearch|Netvibes|NewsGator[^/]{0,30}|^NING|Nutch[^/]{0,30}|Nymesis|ObjectsSearch|OgScrper|Orbiter|OOZBOT|PagePeeker|PagesInventory|PaxleFramework|Peeplo Screenshot Bot|PHPCrawl|PlantyNet_WebRobot|Pompos|Qwantify|Read%20Later|Reaper|RedCarpet|Retreiver|Riddler|Rival IQ|scooter|Scrapy|Scrubby|searchsight|seekbot|semanticdiscovery|SemrushBot|Simpy|SimplePie|SEOstats|SimpleRSS|SiteCon|Slackbot-LinkExpanding|Slack-ImgProxy|Slurp|snappy|Speedy Spider|Squrl Java|Stringer|TheUsefulbot|ThumbShotsBot|Thumbshots\.ru|Tiny Tiny RSS|Twitterbot|WhatsApp|URL2PNG|Vagabondo|VoilaBot|^vortex|Votay bot|^voyager|WASALive.Bot|Web-sniffer|WebThumb|WeSEE:[A-z]{1,30}|WhatWeb|WIRE|WordPress|Wotbox|www\.almaden\.ibm\.com|Xenu(?:.s|) Link Sleuth|Xerka [A-z]{1,30}Bot|yacy(?:bot|)|YahooSeeker|Yahoo! Slurp|Yandex\w{1,30}|YodaoBot(?:-[A-z]{1,30}|)|YottaaMonitor|Yowedo|^Zao|^Zao-Crawler|ZeBot_www\.ze\.bz|ZooShot|ZyBorg|ArcGIS Hub Indexer|GPTBot|Google-InspectionTool)(?:[ /]v?(\d+)(?:\.(\d+)(?:\.(\d+)|)|)|)'

# AWS S3 Clients

# must come before "Bots General matcher" to catch "boto"/"boto3" before "bot"

- regex: '\b(Boto3?|JetS3t|aws-(?:cli|sdk-(?:cpp|go|go-v\d|java|nodejs|ruby2?|dotnet-(?:\d{1,2}|core)))|s3fs)/(\d+)\.(\d+)(?:\.(\d+)|)'

# SAFE FME

- regex: '(FME)\/(\d+\.\d+)\.(\d+)\.(\d+)'

# QGIS

- regex: '(QGIS)\/(\d)\.?0?(\d{1,2})\.?0?(\d{1,2})'

# JOSM

- regex: '(JOSM)/(\d+)\.(\d+)'

# Tygron Platform

- regex: '(Tygron Platform) \((\d+)\.(\d+)\.(\d+(?:\.\d+| RC \d+\.\d+))'

# Facebook

# Must come before "Bots General matcher" to catch OrangeBotswana

# Facebook Messenger must go before Facebook

- regex: '\[(FBAN/MessengerForiOS|FB_IAB/MESSENGER);FBAV/(\d+)(?:\.(\d+)(?:\.(\d+)(?:\.(\d+)|)|)|)'

family_replacement: 'Facebook Messenger'

# Facebook

- regex: '\[FB.{0,300};(FBAV)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Facebook'

# Sometimes Facebook does not specify a version (FBAV)

- regex: '\[FB.{0,300};'

family_replacement: 'Facebook'

# RecipeRadar crawler

- regex: '(RecipeRadar)/(\d+)\.(\d+)(?:\.(\d+)|)'

# Bots General matcher 'name/0.0'

- regex: '^.{0,200}?(?:\/[A-Za-z0-9\.]{0,50}|) {0,2}([A-Za-z0-9 \-_\!\[\]:]{0,50}(?:[Aa]rchiver|[Ii]ndexer|[Ss]craper|[Bb]ot|[Ss]pider|[Cc]rawl[a-z]{0,50}))[/ ](\d+)(?:\.(\d+)(?:\.(\d+)|)|)'

# Bots containing bot(but not CUBOT)

- regex: '^.{0,200}?((?:[A-Za-z][A-Za-z0-9 -]{0,50}|)[^C][^Uu][Bb]ot)\b(?:(?:[ /]| v)(\d+)(?:\.(\d+)|)(?:\.(\d+)|)|)'

# Bots containing spider|scrape|Crawl

- regex: '^.{0,200}?((?:[A-z0-9]{1,50}|[A-z\-]{1,50} ?|)(?: the |)(?:[Ss][Pp][Ii][Dd][Ee][Rr]|[Ss]crape|[Cc][Rr][Aa][Ww][Ll])[A-z0-9]{0,50})(?:(?:[ /]| v)(\d+)(?:\.(\d+)|)(?:\.(\d+)|)|)'

# HbbTV standard defines what features the browser should understand.

# but it's like targeting "HTML5 browsers", effective browser support depends on the model

# See os_parsers if you want to target a specific TV

- regex: '(HbbTV)/(\d+)\.(\d+)\.(\d+) \('

# must go before Firefox to catch Chimera/SeaMonkey/Camino/Waterfox

- regex: '(Chimera|SeaMonkey|Camino|Waterfox)/(\d+)\.(\d+)\.?([ab]?\d+[a-z]*|)'

# must be before Firefox / Gecko to catch SailfishBrowser properly

- regex: '(SailfishBrowser)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Sailfish Browser'

# Social Networks (non-Facebook)

# Pinterest

- regex: '\[(Pinterest)/[^\]]{1,50}\]'

- regex: '(Pinterest)(?: for Android(?: Tablet|)|)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

# Instagram app

# iOS Instagram embeds the token inside a full WebKit UA:

# Mozilla/5.0 (iPhone; ...) Mobile/... Instagram VERSION (...)

# Android Instagram uses a bare format with no browser wrapper:

# Instagram VERSION Android (...)

- regex: 'Mozilla.{1,200}Mobile.{1,100}(Instagram).(\d+)\.(\d+)\.(\d+)'

- regex: '(Instagram) (\d+)\.(\d+)\.(\d+)'

# Flipboard app

- regex: 'Mozilla.{1,200}Mobile.{1,100}(Flipboard).(\d+)\.(\d+)\.(\d+)'

# Flipboard-briefing app

- regex: 'Mozilla.{1,200}Mobile.{1,100}(Flipboard-Briefing).(\d+)\.(\d+)\.(\d+)'

# Onefootball app

- regex: 'Mozilla.{1,200}Mobile.{1,100}(Onefootball)\/Android.(\d+)\.(\d+)\.(\d+)'

# Snapchat

- regex: '(Snapchat)\/(\d+)\.(\d+)\.(\d+)\.(\d+)'

# Twitter

- regex: '(Twitter for (?:iPhone|iPad)|TwitterAndroid)(?:\/(\d+)\.(\d+)|)'

family_replacement: 'Twitter'

# TikTok

- regex: '(musical_ly) app_version\/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'TikTok'

- regex: '(musical_ly_)(\d+)\.(\d+)\.(\d+)'

family_replacement: 'TikTok'

- regex: '(BytedanceWebview)\/[a-z0-9]+'

family_replacement: 'TikTok'

# KakaoTalk

- regex: 'Mozilla.{1,200}Mobile.{1,100}(KAKAOTALK)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'KakaoTalk'

# Telegram

- regex: '(Telegram-Android)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Telegram'

# Phantom app

- regex: 'Mozilla.{1,200}Mobile.{1,100}(Phantom\/ios|Phantom\/android).(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Phantom'

# aspiegel.com spider (owned by Huawei, later called PetalBot)

- regex: 'Mozilla.{1,100}Mobile.{1,100}(AspiegelBot|PetalBot)'

family_replacement: 'Spider'

- regex: 'AspiegelBot|PetalBot'

family_replacement: 'Spider'

# Basilisk

- regex: '(Firefox)/(\d+)\.(\d+) Basilisk/(\d+)'

family_replacement: 'Basilisk'

# Pale Moon

- regex: '(PaleMoon)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Pale Moon'

# Camoufox - anti-detect Firefox fork for web scraping/automation; replaces the

# Firefox version token with "Camoufox Camoufox VERSION" in the UA string

- regex: '(Camoufox) Camoufox (\d+)\.(\d+)'

# Firefox

- regex: '(Fennec)/(\d+)\.(\d+)\.?([ab]?\d+[a-z]*)'

family_replacement: 'Firefox Mobile'

- regex: '(Fennec)/(\d+)\.(\d+)(pre)'

family_replacement: 'Firefox Mobile'

- regex: '(Fennec)/(\d+)\.(\d+)'

family_replacement: 'Firefox Mobile'

- regex: '(?:Mobile|Tablet);.{0,200}(Firefox)/(\d+)\.(\d+)'

family_replacement: 'Firefox Mobile'

- regex: '(Namoroka|Shiretoko|Minefield)/(\d+)\.(\d+)\.(\d+(?:pre|))'

family_replacement: 'Firefox ($1)'

- regex: '(Firefox)/(\d+)\.(\d+)(a\d+[a-z]*)'

family_replacement: 'Firefox Alpha'

- regex: '(Firefox)/(\d+)\.(\d+)(b\d+[a-z]*)'

family_replacement: 'Firefox Beta'

- regex: '(Firefox)-(?:\d+\.\d+|)/(\d+)\.(\d+)(a\d+[a-z]*)'

family_replacement: 'Firefox Alpha'

- regex: '(Firefox)-(?:\d+\.\d+|)/(\d+)\.(\d+)(b\d+[a-z]*)'

family_replacement: 'Firefox Beta'

- regex: '(Namoroka|Shiretoko|Minefield)/(\d+)\.(\d+)([ab]\d+[a-z]*|)'

family_replacement: 'Firefox ($1)'

- regex: '(Firefox).{0,200}Tablet browser (\d+)\.(\d+)\.(\d+)'

family_replacement: 'MicroB'

- regex: '(MozillaDeveloperPreview)/(\d+)\.(\d+)([ab]\d+[a-z]*|)'

- regex: '(FxiOS)/(\d+)\.(\d+)(\.(\d+)|)(\.(\d+)|)'

family_replacement: 'Firefox iOS'

# e.g.: Flock/2.0b2

- regex: '(Flock)/(\d+)\.(\d+)(b\d+?)'

# RockMelt

- regex: '(RockMelt)/(\d+)\.(\d+)\.(\d+)'

# e.g.: Fennec/0.9pre

- regex: '(Navigator)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Netscape'

- regex: '(Navigator)/(\d+)\.(\d+)([ab]\d+)'

family_replacement: 'Netscape'

- regex: '(Netscape6)/(\d+)\.(\d+)\.?([ab]?\d+|)'

family_replacement: 'Netscape'

- regex: '(MyIBrow)/(\d+)\.(\d+)'

family_replacement: 'My Internet Browser'

# UC Browser

# we need check it before opera. In other case case UC Browser detected look like Opera Mini

- regex: '(UC? ?Browser|UCWEB|UCMobile|U3)[ /]?(\d+)\.(\d+)\.(\d+)'

family_replacement: 'UC Browser'

# Opera will stop at 9.80 and hide the real version in the Version string.

# see: http://dev.opera.com/articles/view/opera-ua-string-changes/

- regex: '(Opera Tablet).{0,200}Version/(\d+)\.(\d+)(?:\.(\d+)|)'

- regex: '(Opera Mini)(?:/att|)/?(\d+|)(?:\.(\d+)|)(?:\.(\d+)|)'

- regex: '(Opera)/.{1,100}Opera Mobi.{1,100}Version/(\d+)\.(\d+)'

family_replacement: 'Opera Mobile'

- regex: '(Opera)/(\d+)\.(\d+).{1,100}Opera Mobi'

family_replacement: 'Opera Mobile'

- regex: 'Opera Mobi.{1,100}(Opera)(?:/|\s+)(\d+)\.(\d+)'

family_replacement: 'Opera Mobile'

- regex: 'Opera Mobi'

family_replacement: 'Opera Mobile'

- regex: '(Opera)/9.80.{0,200}Version/(\d+)\.(\d+)(?:\.(\d+)|)'

# Opera 14 for Android uses a WebKit render engine.

- regex: '(?:Mobile Safari).{1,300}(OPR)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Opera Mobile'

# Opera >=15 for Desktop is similar to Chrome but includes an "OPR" Version string.

- regex: '(?:Chrome).{1,300}(OPR)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Opera'

# Opera GX uses "OPX" instead of "OPR"

- regex: '(OPX)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Opera GX'

# Opera Touch uses "OPT"

- regex: '(OPT)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Opera Touch'

# Opera Coast

- regex: '(Coast)/(\d+).(\d+).(\d+)'

family_replacement: 'Opera Coast'

# Opera Mini for iOS (from version 8.0.0)

- regex: '(OPiOS)/(\d+).(\d+).(\d+)'

family_replacement: 'Opera Mini'

# Opera Neon

- regex: 'Chrome/.{1,200}( MMS)/(\d+).(\d+).(\d+)'

family_replacement: 'Opera Neon'

# Palm WebOS looks a lot like Safari.

- regex: '(hpw|web)OS/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'webOS Browser'

# LuaKit has no version info.

# http://luakit.org/projects/luakit/

- regex: '(luakit)'

family_replacement: 'LuaKit'

# Snowshoe

- regex: '(Snowshoe)/(\d+)\.(\d+).(\d+)'

# Lightning (for Thunderbird)

# http://www.mozilla.org/projects/calendar/lightning/

- regex: 'Gecko/\d+ (Lightning)/(\d+)\.(\d+)\.?((?:[ab]?\d+[a-z]*)|(?:\d*))'

# Swiftfox

- regex: '(Firefox)/(\d+)\.(\d+)\.(\d+(?:pre|)) \(Swiftfox\)'

family_replacement: 'Swiftfox'

- regex: '(Firefox)/(\d+)\.(\d+)([ab]\d+[a-z]*|) \(Swiftfox\)'

family_replacement: 'Swiftfox'

# Rekonq

- regex: '(rekonq)/(\d+)\.(\d+)(?:\.(\d+)|) Safari'

family_replacement: 'Rekonq'

- regex: 'rekonq'

family_replacement: 'Rekonq'

# Conkeror lowercase/uppercase

# http://conkeror.org/

- regex: '(conkeror|Conkeror)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Conkeror'

# catches lower case konqueror

- regex: '(konqueror)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Konqueror'

- regex: '(WeTab)-Browser'

- regex: '(Comodo_Dragon)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Comodo Dragon'

- regex: '(Symphony) (\d+).(\d+)'

- regex: 'PLAYSTATION 3.{1,200}WebKit'

family_replacement: 'NetFront NX'

- regex: 'PLAYSTATION 3'

family_replacement: 'NetFront'

- regex: '(PlayStation Portable)'

family_replacement: 'NetFront'

- regex: '(PlayStation Vita)'

family_replacement: 'NetFront NX'

- regex: 'AppleWebKit.{1,200} (NX)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'NetFront NX'

- regex: '(Nintendo 3DS)'

family_replacement: 'NetFront NX'

# Huawei Browser, should go before Safari and Chrome Mobile

- regex: '(HuaweiBrowser)/(\d+)\.(\d+)\.(\d+)\.\d+'

family_replacement: 'Huawei Browser'

# AVG

- regex: '(AVG)/(\d+)\.(\d+)\.(\d+)\.\d+'

family_replacement: 'AVG'

# Avast

- regex: '(AvastSecureBrowser|Avast)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Avast Secure Browser'

# Instabridge

- regex: '(Instabridge)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

# Aloha Browser

- regex: '(AlohaBrowser|ABB)/(\d+)\.(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Aloha Browser'

# Brave Browser, should go before Safari and Chrome Mobile

- regex: '((?:B|b)rave(?:\sChrome)?)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Brave'

# Brave iOS Browser, checks for (Brave) or Brave at end

- regex: '(?:\()?Brave(?:\))?\s*$'

family_replacement: 'Brave'

# Amazon Silk, should go before Safari and Chrome Mobile

- regex: '(Silk)/(\d+)\.(\d+)(?:\.([0-9\-]+)|)'

family_replacement: 'Amazon Silk'

# @ref: http://www.puffinbrowser.com

- regex: '(Puffin)/(\d+)\.(\d+)(?:\.(\d+)|)'

# Edge Mobile

- regex: 'Windows Phone .{0,200}(Edge)/(\d+)\.(\d+)'

family_replacement: 'Edge Mobile'

- regex: '(EdgiOS|EdgA)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Edge Mobile'

# Oculus Browser, should go before Samsung Internet

- regex: '(OculusBrowser)/(\d+)\.(\d+)(?:\.([0-9\-]+)|)'

family_replacement: 'Oculus Browser'

# Samsung Internet (based on Chrome, but lacking some features)

- regex: '(SamsungBrowser)/(\d+)\.(\d+)'

family_replacement: 'Samsung Internet'

# Seznam.cz browser (based on WebKit)

- regex: '(SznProhlizec)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Seznam prohlížeč'

# Coc Coc browser, based on Chrome (used in Vietnam)

- regex: '(coc_coc_browser)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Coc Coc'

# MxBrowser is Maxthon. Must go before Mobile Chrome for Android

- regex: '(MxBrowser)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Maxthon'

# Crosswalk must go before Mobile Chrome for Android

- regex: '(Crosswalk)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

# LINE https://line.me/en/

# Must go before Mobile Chrome for Android

- regex: '(Line)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'LINE'

# MiuiBrowser should got before Mobile Chrome for Android

- regex: '(MiuiBrowser)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'MiuiBrowser'

# Mint Browser should got before Mobile Chrome for Android

- regex: '(Mint Browser)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Mint Browser'

# TopBuzz Android must go before Chrome Mobile WebView

- regex: '(TopBuzz)/(\d+).(\d+).(\d+)'

family_replacement: 'TopBuzz'

# Google Search App on Android, eg:

- regex: 'Mozilla.{1,200}Android.{1,200}(GSA)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Google'

# Baidu Browsers (desktop spoofs chrome & IE, explorer is mobile)

- regex: '(baidubrowser)[/\s](\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Baidu Browser'

- regex: '(FlyFlow|flyflow|baiduboxapp)/(\d+)\.(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Baidu Explorer'

# QQ Browsers

- regex: '(MQQBrowser/Mini)(?:(\d+)(?:\.(\d+)|)(?:\.(\d+)|)|)'

family_replacement: 'QQ Browser Mini'

- regex: '(MQQBrowser)(?:/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)|)'

family_replacement: 'QQ Browser Mobile'

- regex: '(QQBrowser)(?:/(\d+)(?:\.(\d+)\.(\d+)(?:\.(\d+)|)|)|)'

family_replacement: 'QQ Browser'

# DuckDuckGo

- regex: 'Mozilla.{1,200}Mobile.{1,100}(DuckDuckGo)/(\d+)'

family_replacement: 'DuckDuckGo Mobile'

- regex: 'Mozilla.{1,200}(DuckDuckGo)/(\d+)'

family_replacement: 'DuckDuckGo'

- regex: 'Mozilla.{1,200}Mobile.{1,100}(Ddg)/(\d+)(?:\.(\d+)|)'

family_replacement: 'DuckDuckGo Mobile'

- regex: 'Mozilla.{1,200}(Ddg)/(\d+)(?:\.(\d+)|)'

family_replacement: 'DuckDuckGo'

# Tenta Browser

- regex: '(Tenta/)(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Tenta Browser'

# Ecosia on iOS / Android

- regex: '(Ecosia) ios@(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Ecosia iOS'

- regex: '(Ecosia) android@(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Ecosia Android'

# VivoBrowser

- regex: '(VivoBrowser)\/(\d+)\.(\d+)\.(\d+)(?:\.(\d+)|)'

# HiBrowser

- regex: '(H[Ii]Browser)\/v(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'HiBrowser'

# Honor Browser

- regex: '(HonorBrowser)/(\d+)\.(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Honor Browser'

# Honor Browser

- regex: '(bdhonorbrowser)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Honor Browser'

# HeyTap Browser

- regex: '(HeyTapBrowser)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'HeyTap Browser'

# Weibo

# Must before Chrome Mobile WebView

- regex: '(weibo)__(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Weibo'

- regex: '(WeiboliteiOS|WeiboIntliOS)'

family_replacement: 'Weibo'

# Phoenix Browser

- regex: '(PHX)/(\d+)\.(\d+)'

family_replacement: 'Phoenix Browser'

# Chrome Mobile

- regex: 'Version/.{1,300}(Chrome)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Chrome Mobile WebView'

- regex: '; wv\).{1,300}(Chrome)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Chrome Mobile WebView'

- regex: '(CrMo)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Chrome Mobile'

- regex: '(CriOS)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Chrome Mobile iOS'

- regex: '(Chrome)/(\d+)\.(\d+)\.(\d+)\.(\d+) Mobile(?:[ /]|$)'

family_replacement: 'Chrome Mobile'

- regex: ' Mobile .{1,300}(Chrome)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Chrome Mobile'

# Chrome Frame must come before MSIE.

- regex: '(chromeframe)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Chrome Frame'

# Tizen Browser (second case included in browser/major.minor regex)

- regex: '(SLP Browser)/(\d+)\.(\d+)'

family_replacement: 'Tizen Browser'

# Sogou Explorer 2.X

- regex: '(SE 2\.X) MetaSr (\d+)\.(\d+)'

family_replacement: 'Sogou Explorer'

# Rackspace Monitoring

- regex: '(Rackspace Monitoring)/(\d+)\.(\d+)'

family_replacement: 'RackspaceBot'

# PRTG Network Monitoring

- regex: '(PRTG Network Monitor)'

# PyAMF

- regex: '(PyAMF)/(\d+)\.(\d+)\.(\d+)'

# Yandex Browser

- regex: '(YaBrowser)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Yandex Browser'

- regex: '(YaSearchBrowser)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Yandex Browser'

# Mail.ru Amigo/Internet Browser (Chromium-based)

- regex: '(Chrome)/(\d+)\.(\d+)\.(\d+).{0,100} MRCHROME'

family_replacement: 'Mail.ru Chromium Browser'

# AOL Browser (IE-based)

- regex: '(AOL) (\d+)\.(\d+); AOLBuild (\d+)'

# Podcast catcher Applications using iTunes

- regex: '(PodCruncher|Downcast)[ /]?(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|)'

# Box Notes https://www.box.com/resources/downloads

# Must be before Electron

- regex: ' (BoxNotes)/(\d+)\.(\d+)\.(\d+)'

# Whale

- regex: '(Whale)/(\d+)\.(\d+)\.(\d+)\.(\d+) Mobile(?:[ /]|$)'

family_replacement: 'Whale'

- regex: '(Whale)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Whale'

# 1Password

- regex: '(1Password)/(\d+)\.(\d+)\.(\d+)'

# Ghost

# @ref: http://www.ghost.org

- regex: '(Ghost)/(\d+)\.(\d+)\.(\d+)'

# Palo Alto GlobalProtect Linux

- regex: 'PAN (GlobalProtect)/(\d+)\.(\d+)\.(\d+) .{1,100} \(X11; Linux x86_64\)'

# Surveyon https://www.surveyon.com/

- regex: '^(surveyon)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Surveyon'

# 115 Browser

- regex: '(115Browser)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: '115 Browser'

# Avira

- regex: '(Avira)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Avira'

# CCleaner Browser

- regex: '(CCleaner)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'CCleaner'

# Norton

- regex: '(Norton)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Norton'

# Quark

- regex: '(Quark)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Quark'

# Quark PC

- regex: '(QuarkPC)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Quark PC'

# Smart Lenovo Browser

- regex: '(SLBrowser)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Smart Lenovo Browser'

# Atom Browser

- regex: '(Atom)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Atom Browser'

# 360 Secure Browser

- regex: '(Chrome)/\d+\.\d+\.\d+\.\d+ .* QIHU 360(?:SEi18n|ENT)'

family_replacement: '360 Secure Browser'

# Decentr Web3 Browser

- regex: '(Decentr)'

family_replacement: 'Decentr Web3 Browser'

# Sparrow Browser

- regex: '(Sparrow)'

family_replacement: 'Sparrow Browser'

# Chromium GOST Browser

- regex: '(Chromium GOST)'

family_replacement: 'Chromium GOST Browser'

# AOL Shield Browser

- regex: '(AOLShield)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'AOL Shield Browser'

# Hola Browser

- regex: '(Hola)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Hola Browser'

# Craving Explorer Browser

- regex: '(CravingExplorer)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Craving Explorer Browser'

# Talon Cyber Security Browser

- regex: '(Talon)'

family_replacement: 'Talon Cyber Security Browser'

# QAX Browser

- regex: '(Qaxbrowser)'

family_replacement: 'QAX Browser'

# AOL Desktop Gold Browser

- regex: '(ADG)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'AOL Desktop Gold Browser'

# Sber Browser

- regex: '(SberBrowser)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Sber Browser'

# JiSu Browser

- regex: '(JiSu)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'JiSu Browser'

# Wolvic Browser

- regex: '(Wolvic)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Wolvic Browser'

# SmartTV WebBrowser

- regex: '(Thano)/(\d+)\.(\d+)'

family_replacement: 'SmartTV WebBrowser'

# WeChat Browser

- regex: '(MicroMessenger)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'WeChat Browser'

# Odin Browser

- regex: '(Odin)/(\d+)\.(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Odin'

# NetCast Smart TV

- regex: '(Colt)/(\d+)\.(\d+)'

family_replacement: 'NetCast Smart TV'

# Lite Browser

- regex: '(Lite Browser)/(\d+)\.(\d+)'

family_replacement: 'Lite Browser'

# Vewd Browser

- regex: '(OMI)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Vewd Browser'

# Mypal

- regex: '(Mypal)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Mypal Browser'

# Chess.com native app

- regex: '(Chesscom-Android)/(\d+)\.(\d+)\.(\d+)'

# Roblox native app

- regex: '(RobloxApp)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Roblox App'

# Roadrunner iOS app (not the legacy Time Warner Cable ISP identifier)

- regex: '(Roadrunner)/IOS/\d+/(\d+)\.(\d+)\.(\d+)'

# Ancestry.com Android app

- regex: '(AncestryAndroid)/(\d+)\.(\d+)(?:\.(\d+)|)'

#### END SPECIAL CASES TOP ####

#### MAIN CASES - this catches > 50% of all browsers ####

# Slack desktop client (needs to be before Apple Mail, Electron, and Chrome as it gets wrongly detected on Mac OS otherwise)

- regex: '(Slack_SSB)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Slack Desktop Client'

# HipChat provides a version on Mac, but not on Windows.

# Needs to be before Chrome on Windows, and AppleMail on Mac.

- regex: '(HipChat)/?(\d+|)'

family_replacement: 'HipChat Desktop Client'

# Browser/major_version.minor_version.beta_version

- regex: '\b(MobileIron|FireWeb|Jasmine|ANTGalio|Midori|Fresco|Lobo|PaleMoon|Maxthon|Lynx|OmniWeb|Dillo|Camino|Demeter|Fluid|Fennec|Epiphany|Shiira|Sunrise|Spotify|Flock|Netscape|Lunascape|WebPilot|NetFront|Netfront|Konqueror|SeaMonkey|Kazehakase|Vienna|Iceape|Iceweasel|IceWeasel|Iron|K-Meleon|Sleipnir|Galeon|GranParadiso|Opera Mini|iCab|NetNewsWire|ThunderBrowse|Iris|UP\.Browser|Bunjalloo|Google Earth|Raven for Mac|Openwave|MacOutlook|Electron|OktaMobile)/(\d+)\.(\d+)\.(\d+)'

# Outlook 2007

- regex: 'Microsoft Office Outlook 12\.\d+\.\d+|MSOffice 12'

family_replacement: 'Outlook'

v1_replacement: '2007'

# Outlook 2010

- regex: 'Microsoft Outlook 14\.\d+\.\d+|MSOffice 14'

family_replacement: 'Outlook'

v1_replacement: '2010'

# Outlook 2013

- regex: 'Microsoft Outlook 15\.\d+\.\d+'

family_replacement: 'Outlook'

v1_replacement: '2013'

# Outlook 2016

- regex: 'Microsoft Outlook (?:Mail )?16\.\d+\.\d+|MSOffice 16'

family_replacement: 'Outlook'

v1_replacement: '2016'

# Word 2014

- regex: 'Microsoft Office (Word) 2014'

# Windows Live Mail

- regex: 'Outlook-Express\/7\.0'

family_replacement: 'Windows Live Mail'

# Apple Air Mail

- regex: '(Airmail) (\d+)\.(\d+)(?:\.(\d+)|)'

# Thunderbird

- regex: '(Thunderbird)/(\d+)\.(\d+)(?:\.(\d+(?:pre|))|)'

family_replacement: 'Thunderbird'

# Postbox

- regex: '(Postbox)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Postbox'

# Barca

- regex: '(Barca(?:Pro)?)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Barca'

# Lotus Notes

- regex: '(Lotus-Notes)/(\d+)\.(\d+)(?:\.(\d+)|)'

family_replacement: 'Lotus Notes'

# Superhuman Mail Client

# @ref: https://www.superhuman.com

- regex: 'Superhuman'

family_replacement: 'Superhuman'

# Vivaldi

- regex: '(Vivaldi)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

# Edge/major_version.minor_version

# Edge with chromium Edg/major_version.minor_version.patch.minor_patch

- regex: '(Edge?)/(\d+)(?:\.(\d+)|)(?:\.(\d+)|)(?:\.(\d+)|)'

family_replacement: 'Edge'

# Iron Browser ~since version 50

- regex: '(Chrome)/(\d+)\.(\d+)\.(\d+)[\d.]{0,100} Iron[^/]'

family_replacement: 'Iron'

# Dolphin Browser

# @ref: http://www.dolphin.com

- regex: '\b(Dolphin)(?: |HDCN/|/INT\-)(\d+)\.(\d+)(?:\.(\d+)|)'

# Headless Chrome

# https://chromium.googlesource.com/chromium/src/+/lkgr/headless/README.md

- regex: '(HeadlessChrome)(?:/(\d+)\.(\d+)\.(\d+)|)'

# Evolution Mail CardDav/CalDav integration

- regex: '(Evolution)/(\d+)\.(\d+)\.(\d+\.\d+)'

# Roundcube Mail CardDav plugin

- regex: '(RCM CardDAV plugin)/(\d+)\.(\d+)\.(\d+(?:-dev|))'

# Browser/major_version.minor_version

- regex: '(bingbot|Bolt|AdobeAIR|Jasmine|IceCat|Skyfire|Midori|Maxthon|Lynx|Arora|IBrowse|Dillo|Camino|Shiira|Fennec|Phoenix|Flock|Netscape|Lunascape|Epiphany|WebPilot|Opera Mini|Opera|NetFront|Netfront|Konqueror|Googlebot|SeaMonkey|Kazehakase|Vienna|Iceape|Iceweasel|IceWeasel|Iron|K-Meleon|Sleipnir|Galeon|GranParadiso|iCab|iTunes|MacAppStore|NetNewsWire|Space Bison|Stainless|Orca|Dolfin|BOLT|Minimo|Tizen Browser|Polaris|Abrowser|Planetweb|ICE Browser|mDolphin|qutebrowser|Otter|QupZilla|MailBar|kmail2|YahooMobileMail|ExchangeWebServices|ExchangeServicesClient|Dragon|Outlook-iOS-Android)/(\d+)\.(\d+)(?:\.(\d+)|)'

# Qt Web Engine embedded browser, must be before Chrome

- regex: '(QtWebEngine)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Qt Web Engine'

# OpenWave browser (Chromium-based), must be before Chrome

- regex: '(OpenWave)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Open Wave'

# AtContent - confirmed APT29/Nobelium (Cozy Bear) C2 malware marker. The implant

# (AcroSup.dll, side-loaded via Adobe WCChromeNativeMessagingHost.exe) uses a hardcoded

# UA of the form 'Chrome/100.0.4896.75 Safari/537.36 AtContent/91.5.2444.45' to

# communicate with Dropbox C2. Also observed appended after Edg/ tokens.

# Source: Cluster25/DuskRise 'Cozy Smuggled Into the Box', May 2022

# (https://www.duskrise.com/2022/05/13/cozy-smuggled-into-the-box-apt29-abusing-legitimate-software-for-targeted-operations-in-europe/)

- regex: '(AtContent)/(\d+)\.(\d+)\.(\d+)'

# Trailer - suspicious fake UA token appended to Chrome/Edge/Opera UA strings

# (TOKEN/MAJOR.MINOR.BUILD.PATCH). No known legitimate browser uses this token.

# Structurally identical to AtContent (confirmed APT29/Nobelium C2 marker; see

# Cluster25/DuskRise 'Cozy Smuggled Into the Box', May 2022). Unconfirmed attribution;

# may be same actor rotating token names or a copycat using the same spoofing technique.

- regex: '(Trailer)/(\d+)\.(\d+)\.(\d+)'

# Agency - suspicious fake UA token appended to Chrome UA strings

# (TOKEN/MAJOR.MINOR.BUILD.PATCH). No known legitimate browser uses this token.

# Structurally identical to AtContent (confirmed APT29/Nobelium C2 marker; see

# Cluster25/DuskRise 'Cozy Smuggled Into the Box', May 2022). Unconfirmed attribution;

# may be same actor rotating token names or a copycat using the same spoofing technique.

- regex: '(Agency)/(\d+)\.(\d+)\.(\d+)'

# Herring - suspicious fake UA token appended to Chrome UA strings

# (TOKEN/MAJOR.MINOR.BUILD.PATCH). No known legitimate browser uses this token.

# Structurally identical to AtContent (confirmed APT29/Nobelium C2 marker; see

# Cluster25/DuskRise 'Cozy Smuggled Into the Box', May 2022). Unconfirmed attribution;

# may be same actor rotating token names or a copycat using the same spoofing technique.

- regex: '(Herring)/(\d+)\.(\d+)\.(\d+)'

# Config - suspicious fake UA token appended to Chrome UA strings

# (TOKEN/MAJOR.MINOR.BUILD.PATCH). No known legitimate browser uses this token.

# Structurally identical to AtContent (confirmed APT29/Nobelium C2 marker; see

# Cluster25/DuskRise 'Cozy Smuggled Into the Box', May 2022). Unconfirmed attribution;

# may be same actor rotating token names or a copycat using the same spoofing technique.

- regex: '(Config)/(\d+)\.(\d+)\.(\d+)'

# Viewer - suspicious fake UA token appended to Chrome UA strings

# (TOKEN/MAJOR.MINOR.BUILD.PATCH). No known legitimate browser uses this token.

# Structurally identical to AtContent (confirmed APT29/Nobelium C2 marker; see

# Cluster25/DuskRise 'Cozy Smuggled Into the Box', May 2022). Unconfirmed attribution;

# may be same actor rotating token names or a copycat using the same spoofing technique.

- regex: '(Viewer)/(\d+)\.(\d+)\.(\d+)'

# LikeWise - suspicious fake UA token appended to Chrome UA strings

# (TOKEN/MAJOR.MINOR.BUILD.PATCH). No known legitimate browser uses this token.

# Structurally identical to AtContent (confirmed APT29/Nobelium C2 marker; see

# Cluster25/DuskRise 'Cozy Smuggled Into the Box', May 2022). Unconfirmed attribution;

# may be same actor rotating token names or a copycat using the same spoofing technique.

- regex: '(LikeWise)/(\d+)\.(\d+)\.(\d+)'

# Unique - suspicious fake UA token appended to Chrome/Opera UA strings

# (TOKEN/MAJOR.MINOR.BUILD.PATCH). No known legitimate browser uses this token.

# Structurally identical to AtContent (confirmed APT29/Nobelium C2 marker; see

# Cluster25/DuskRise 'Cozy Smuggled Into the Box', May 2022). Unconfirmed attribution;

# may be same actor rotating token names or a copycat using the same spoofing technique.

- regex: '(Unique)/(\d+)\.(\d+)\.(\d+)'

# CitizenFX - embedded Chromium browser in FiveM/RedM (GTA V / RDR2 game mod frameworks)

- regex: '(CitizenFX)/(\d+)\.(\d+)\.(\d+)'

# R2Client - R2Games game launcher embedded browser (CEF-based)

- regex: '(R2Client)/(\d+)\.(\d+)(?:\.(\d+)|)'

# OBS Studio embedded browser (CEF-based, used for browser sources/docks)

- regex: '(OBS)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'OBS Studio'

# Adobe CEP - embedded Chromium runtime for extension panels in Adobe CC apps

- regex: '(AdobeCEP)/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Adobe CEP'

# Steam embedded browsers; version from Chrome. Must be before Chrome.

# GameOverlay = in-game overlay browser (Shift+Tab)

- regex: 'Valve Steam (GameOverlay).{1,200}Chrome/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Steam GameOverlay'

# Steam Deck built-in browser

- regex: 'Valve Steam (Gamepad)/Steam Deck.{1,200}Chrome/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Steam Deck'

# Steam desktop client browser

- regex: '(Valve(?: Steam|) Client).{1,200}Chrome/(\d+)\.(\d+)\.(\d+)'

family_replacement: 'Steam Client'

# Ladybird

- regex: '(Ladybird)/(\d+)\.(\d+)(?:\.(\d+)|)'

# Chrome/Chromium/major_version.minor_version

- regex: '(Chromium|Chrome)/(\d+)\.(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

##########

# IE Mobile needs to happen before Android to catch cases such as:

# Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; NOKIA; Lumia 920)...

# Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; NOKIA; Lumia 920; ANZ821)...

# Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; NOKIA; Lumia 920; Orange)...

# Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; NOKIA; Lumia 920; Vodafone)...

##########

# IE Mobile

- regex: '(IEMobile)[ /](\d+)\.(\d+)'

family_replacement: 'IE Mobile'

# Baca Berita App News Reader

- regex: '(BacaBerita App)\/(\d+)\.(\d+)\.(\d+)'

# Podcast catchers

- regex: '^(bPod|Pocket Casts|Player FM)$'

- regex: '^(AlexaMediaPlayer|VLC)/(\d+)\.(\d+)\.([^.\s]+)'

- regex: '^(AntennaPod|WMPlayer|Zune|Podkicker|Radio|ExoPlayerDemo|Overcast|PocketTunes|NSPlayer|okhttp|DoggCatcher|QuickNews|QuickTime|Peapod|Podcasts|GoldenPod|VLC|Spotify|Miro|MediaGo|Juice|iPodder|gPodder|Banshee)/(\d+)\.(\d+)(?:\.(\d+)|)(?:\.(\d+)|)'

- regex: '^(Peapod|Liferea)/([^.\s]+)\.([^.\s]+|)\.?([^.\s]+|)'

- regex: '^(bPod|Player FM) BMID/(\S+)'

- regex: '^(Podcast ?Addict)/v(\d+) '

- regex: '^(Podcast ?Addict) '

family_replacement: 'PodcastAddict'

- regex: '(Replay) AV'

- regex: '(VOX) Music Player'

- regex: '(CITA) RSS Aggregator/(\d+)\.(\d+)'

- regex: '(Pocket Casts)$'

- regex: '(Player FM)$'

- regex: '(LG Player|Doppler|FancyMusic|MediaMonkey|Clementine) (\d+)\.(\d+)\.?([^.\s]+|)\.?([^.\s]+|)'

- regex: '(philpodder)/(\d+)\.(\d+)\.?([^.\s]+|)\.?([^.\s]+|)'

- regex: '(Player FM|Pocket Casts|DoggCatcher|Spotify|MediaMonkey|MediaGo|BashPodder)'

- regex: '(QuickTime)\.(\d+)\.(\d+)\.(\d+)'

- regex: '(Kinoma)(\d+)'

- regex: '(Fancy) Cloud Music (\d+)\.(\d+)'

family_replacement: 'FancyMusic'

- regex: 'EspnDownloadManager'

family_replacement: 'ESPN'

- regex: '(ESPN) Radio (\d+)\.(\d+)(?:\.(\d+)|) ?(?:rv:(\d+)|) '

- regex: '(podracer|jPodder) v ?(\d+)\.(\d+)(?:\.(\d+)|)'

- regex: '(ZDM)/(\d+)\.(\d+)[; ]?'

- regex: '(Zune|BeyondPod) (\d+)(?:\.(\d+)|)[\);]'