Msie 11

[lucy24]

Can anyone find the connection?

104.207.155.129 - - [23/Oct/2015:02:12:36 -0700] "GET /ebooks/bourquin/ HTTP/1.1" 200 20754 "-" "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:  11.0) like Gecko" 
<and five other pages (only) from the same directory>

104.46.42.85 - - [23/Oct/2015:07:40:23 -0700] "GET /ebooks/bourquin/ HTTP/1.1" 200 20754 "-" "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:  11.0) like Gecko"
<and four of the above five, in the same order>
23.97.166.57 - - [23/Oct/2015:07:45:02 -0700] "GET /ebooks/kleinschmidt/ HTTP/1.1" 200 14551 "-" "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:  11.0) like Gecko" 
<that was the missing fifth>

The first IP is Choopa; the others are from two of those Mystery Microsoft Ranges [webmasterworld.com] that I don't think anyone has ever quite figured out but I'm very, very hesitant to block.

If it weren't for the identical UA (if you can't see, that's a double space in "rv:  11" while the real MSIE11 has no space at all) I would have assumed they're unrelated robots chewing on the same RSS feed.

[keyplyr]

Is this a test?

[lucy24]

:-P

No, I'm genuinely wondering why two seemingly unrelated entities crawled the same set of pages in the same order on the same day using the same UA (which, incidentally, I have never seen before).

[keyplyr]

Interesting. The Choopa range may be human connectivity, either employees from a company hosting with them or a VPN, proxy or cloud. Or maybe a browser plugin that is gathering the user's behavior.

The M$ hits could be from either a normal user, a developer or a plugin or toolbar.

Any combination of the above.

[lucy24]

Oh, sorry, didn't make myself clear. Definitely no human involvement: just html.

[keyplyr]

Yeah you showed that, I'm just used to assuming differently as of late - didn't consider the whole picture.

So it's a sync'd cron executing a script from 2 different servers; one at Choopa & one at MSN... could happen.