incrediBILL - 6:14 pm on Jul 20, 2012 (gmt 0)
The reason I'm avoiding whitelisting is mobile user agents
That's no excuse not to whitelist as there are way more bad bots to blacklist.
There are some pretty simple ways of detecting mobile agents using a combination of things in the user agent and header that IDs most of them and some simple PHP scripts that already do it.
Worse case, just use browsecap.ini to look them up.