iomfan - 11:25 pm on Nov 5, 2013 (gmt 0)
and thanks for the comments!
Is the first visit always from yahoo or was that just a random example?
No and yes... :) Overall this kind of browser switch doesn't happen very often, but I have seen it also with apparently human users visiting...
Is everything a page file?
Yes - they are all html
I've seen the user-agent switch occasionally myself-- but now that I'm actively looking for it, all examples involve people apparently returning for image files.* Or people on mobiles coming back in a different browser. MSIE 7 vs. 10 is weird, though.
In some cases it may even be the same browser version, but once with and then without (or the other way around) such items like "WOW64" or "en-us" etc. in the UA. Sometimes it is only a switch from version x.0 to x.1 or a similar small variation. Last week, however, I found this special case on a Japanese site I am looking after (interesting point here: the first 4 access time stamps - not sure how a human could do that, but the remote host is a dynamic IP address in Japan):
softbank126009120142.bbtec.net - - [31/Oct/2013:04:21:22 +0900] "GET / HTTP/1.1" 200 2635 "-" "Mozilla/5.0 (X11; U; Linux; ja-JP) AppleWebKit/527+ (KHTML, like Gecko, Safari/419.3)"
softbank126009120142.bbtec.net - - [31/Oct/2013:04:21:23 +0900] "GET / HTTP/1.1" 200 2651 "-" "Mozilla/5.0 (X11; U; Linux x86_64; ja-JP) AppleWebKit/533.3 (KHTML, like Gecko) Qt/4.8.0 Safari/533.3"
softbank126009120142.bbtec.net - - [31/Oct/2013:04:21:23 +0900] "GET / HTTP/1.1" 200 2643 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.34 (KHTML, like Gecko) Qt/4.8.2 Safari/534.34"
softbank126009120142.bbtec.net - - [31/Oct/2013:04:21:23 +0900] "GET / HTTP/1.1" 410 - "-" "-"
softbank126009120142.bbtec.net - - [31/Oct/2013:04:25:28 +0900] "GET / HTTP/1.1" 200 2649 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4"
(Note1: the 410 happened because on that site I block access without user agent that way)
(Note 2: this particular user continued to look at other pages on the site in a leisurely pace, using the last mentioned browser throughout)
Now, about that explicit "index.html"
It's an editing artefact (in reality there was a different page name, but it might have given away what site I am talking about, so I changed it). :)