Changing UA strings from same visitor...

[pendanticist]

216.63.***.*** - - [11/Jan/2005:06:57:28 -0800] "GET / HTTP/1.1" 200 20407 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
216.63.***.*** - - [11/Jan/2005:08:47:25 -0800] "GET / HTTP/1.1" 200 20407 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
216.63.***.*** - - [12/Jan/2005:07:05:40 -0800] "GET / HTTP/1.1" 403 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
216.63.***.*** - - [12/Jan/2005:09:20:42 -0800] "GET / HTTP/1.1" 403 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
216.63.***.*** - - [12/Jan/2005:09:41:50 -0800] "GET / HTTP/1.1" 403 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; (R1 1.5))"

Note: All are - Mozilla/4.0 (compatible; MSIE 6.0.

This one was kinda crafty, wouldn't you say? <chuckle>

I wonder if there is an easier way of detecting UA string changes from one visit to the next, than visually?

[Luddite]

For whatever it's worth, I think you can see different UAs from legitimate traffic, too.

I've got multiple PCs spread around the house, running different flavours of windows/*nix. Sometimes I start reading a thread or article on one machine and finish on another. Odds are slim they will be running the exact same browser OS combo, but the requests are all going to come from my single public address...