The string “null” or actually null? I have recently seen a huge amount of bot traffic which has actually no UA and just outright block it. It’s almost entirely (microsoft cloud) Azure script attacks.

I was thinking the string "null". But if you have a better idea.

User-Agent: '; DROP TABLE blocked_bots;