This is an example of a UA used by a comment spammer:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11
I've noticed more like this lately. UA strings containing 2 or more OS, 2 or more browsers and so on
Is it even possible that a legitimate UA would include Chrome and Safari? Or any 2 or 3 browsers?
How would I write a - Set Env "UAstring" blocked - for this?