User agent appears to change on the fly

Website access log shows one user with 2 UAs

[iomfan]

Hi,

below is a {modified} log excerpt showing something that I've seen on the odd occasion before: someone initially appears to access a certain web site with one browser (UA) but apperas to continue browsing with another.

If anybody has an explanation, here is what I'd like to know:
Is it possible or likely in this case that the user changed browsers?
If so, how did they do that without losing the referer information?
If not, how did the different UAs come about?

{remote_host} - - [04/Nov/2013:13:29:28 +0000] "GET /index.html" 200 3461 "http://search.yahoo.co.jp/search?p={relevant_search_term}" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)"
{remote_host} - - [04/Nov/2013:13:29:59 +0000] "GET /servicemenu.html" 200 11988 "http://www.domain.info/index.html" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
{remote_host} - - [04/Nov/2013:13:32:13 +0000] "GET /fees.html" 200 5864 "http://www.domain.info/servicemenu.html" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"

TIA for any hints or other comments...

[lucy24]

Is the first visit always from yahoo or was that just a random example? If it is always the same referer, you could hypothesize that the first visit is the search engine's humanoid UA doing some pre-loading business. This has been discussed in other contexts (chrome + first-google-result is what comes to mind).

Is everything a page file? I've seen the user-agent switch occasionally myself-- but now that I'm actively looking for it, all examples involve people apparently returning for image files.* Or people on mobiles coming back in a different browser. MSIE 7 vs. 10 is weird, though.

Now, about that explicit "index.html"

:: tweet tweet, chirp chirp ::


* Ones that they are perfectly welcome to keep on their HD for reference. I am not an artist ;) The most recent specimens are either keyboard layouts or illustrations from public-domain books.

[iomfan]

Hi,
and thanks for the comments!

Is the first visit always from yahoo or was that just a random example?

No and yes... :) Overall this kind of browser switch doesn't happen very often, but I have seen it also with apparently human users visiting...

Is everything a page file?

Yes - they are all html

I've seen the user-agent switch occasionally myself-- but now that I'm actively looking for it, all examples involve people apparently returning for image files.* Or people on mobiles coming back in a different browser. MSIE 7 vs. 10 is weird, though.

In some cases it may even be the same browser version, but once with and then without (or the other way around) such items like "WOW64" or "en-us" etc. in the UA. Sometimes it is only a switch from version x.0 to x.1 or a similar small variation. Last week, however, I found this special case on a Japanese site I am looking after (interesting point here: the first 4 access time stamps - not sure how a human could do that, but the remote host is a dynamic IP address in Japan):

softbank126009120142.bbtec.net - - [31/Oct/2013:04:21:22 +0900] "GET / HTTP/1.1" 200 2635 "-" "Mozilla/5.0 (X11; U; Linux; ja-JP) AppleWebKit/527+ (KHTML, like Gecko, Safari/419.3)"
softbank126009120142.bbtec.net - - [31/Oct/2013:04:21:23 +0900] "GET / HTTP/1.1" 200 2651 "-" "Mozilla/5.0 (X11; U; Linux x86_64; ja-JP) AppleWebKit/533.3 (KHTML, like Gecko) Qt/4.8.0 Safari/533.3"
softbank126009120142.bbtec.net - - [31/Oct/2013:04:21:23 +0900] "GET / HTTP/1.1" 200 2643 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.34 (KHTML, like Gecko) Qt/4.8.2 Safari/534.34"
softbank126009120142.bbtec.net - - [31/Oct/2013:04:21:23 +0900] "GET / HTTP/1.1" 410 - "-" "-"
softbank126009120142.bbtec.net - - [31/Oct/2013:04:25:28 +0900] "GET / HTTP/1.1" 200 2649 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4"

(Note1: the 410 happened because on that site I block access without user agent that way)
(Note 2: this particular user continued to look at other pages on the site in a leisurely pace, using the last mentioned browser throughout)

Thanks again!

PS:

Now, about that explicit "index.html"

It's an editing artefact (in reality there was a different page name, but it might have given away what site I am talking about, so I changed it). :)

[phranque]

if it's only requesting html there's a high probability you have a scraper spoofing the user agent string.