In the particular case of Instagram as GP mentions, I'm guessing the devs don't go off of user agent since curl's default user agent is "curl/<installed version num>". Even if they are going off user agent, seems strange to block requests but not curl. GP doesn't mention if they tried to changing the user agent, would be interested to know if Instagram can guess if the client is curl or requests based off other heuristics