X2 about Firefox. I have a set of rules to determine if Firefox 3.x is real. I get a few real Firefox 3 users daily - it seems many didn't like the subsequence versions and 3.x has been maintained up until recently. But I have many many more fake Firefox 3 user agents than real, especially 3.5.6.
Rather than go into detail explaining how to catch the fake versions (since spammers read these forums too) I suggest you take an in-depth look at Firefox's documentation as the information is in there for those willing to dig. :)