I'm adding the string fragment NRD90M to my user-agent blocking strategy. Some examples:

Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36

Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36 (compatible; Google-Read-Aloud; +https://support.google.com/webmasters/answer/1061943)

I mostly see these from 40.77.x.y (Micro$haft IP's that do not resolve to any host names) and 66.249.x.y (x is usually 83, sometimes 93) and these resolve to google-proxy-something. I don't believe that these are part of the usual 47.77 and 66.249 search bot ranges.

The hits from google IP's are innocuous but the hits from MS are usually malicious and frequently try to post files.

I'm already blocking LRX21T and MRA58N when I see them in user-agents. As well as anything that has Chrome/X where X is between 2 and 9.