Safari Technology Preview

[lucy24]

Anyone know what this is?

46.208.221.197 - - [01/Apr/2016:12:33:06 -0700] "GET /games/tower/ HTTP/1.1" 200 2866 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/602.1.25 (KHTML, like Gecko)" 
46.208.221.197 - - [01/Apr/2016:12:33:07 -0700] "GET /apple-touch-icon-precomposed.png HTTP/1.1" 200 1583 "-" "Safari%20Technology%20Preview/11601.6.10 CFNetwork/760.4.2 Darwin/15.4.0 (x86_64)" 
46.208.221.197 - - [01/Apr/2016:12:33:07 -0700] "GET /favicon.ico HTTP/1.1" 200 1751 "-" "Safari%20Technology%20Preview/11601.6.10 CFNetwork/760.4.2 Darwin/15.4.0 (x86_64)" 

The %20 is in the original.

It came in from three different IPs over the course of a day or two, all belonging to PlusNet in the UK. Sometimes more than one set, and wound up with two requests for the page alone. Cross-checking the UA (the Mac one) in earlier logs and comparing IPs makes me wonder if it’s anything analogous to Firefox’s Favicon Reloader?

[iamlost]

Safari Technology Preview is an OSX Preview build in between the Nightlies and stable release Safari that (currently) updates every two weeks via Mac Store software updates. Sort of easy access to what is coming to Safari soon with bug feedback. It can be used by itself or in tandem with other browsers for comparison purposes.

[lucy24]

But what does it want with the favicon? Or, for my purposes: Do I count it as a returning human visitor, or is it just white noise?

[iamlost]

That [ apple-touch-icon-precomposed.png ] is asked for is interesting as the UA (STP aside) is El Capitan (as is the original Mac UA) but apple-touch is an iOS/Android icon.

However, Darwin/15.4.0 is the kernel for both El Capitan and iOS 9. Apple is known to be working at merging iOS and OSX so such a STP request may be an indication of such. That the call was followed by asking for [ favicon.ico ] is either because STP is calling both OR it was told - very quickly given time stamp - you don't have the first.

I think I confused myself with the above.

I believe, based solely on your snippet, that you have one visitor coming from a Mac with El Capitan OS and running the Safari Technology Preview browser in stand alone mode. You have given me something to add to my check-it-out list...apparently cutting edge Safari types don't visit my sites, at least not yet, so say log files.

[lucy24]

:: bump ::

Met another one, and went looking for this thread.

Matter of fact, I don't think it was "another one"; I think it's the same one. It happened to involve a rarely-visited page, so I went back and checked more closely. I think it goes back to a human visit at the end of March, followed by the blizzard of requests on April 1-2. And then again yesterday. Lots of different IPs, but they all resolve to the same ISP in the same country. Same UA, but for a few decimal points.

I think favicon.ico and apple-touch-icon-precomposed.png are on the standard shopping list, because it always requests both. I don't know if a 404 on apple-touch-icon-precomposed-- which I happen to have on that site-- would lead to requests for other formats (there are dozens, in different sizes, with and without "-precomposed"); I kinda think no. Don't know why they start with "precomposed" either; it's not the default first choice. Especially for non-mobiles, of course ;)

The two icon requests come in random order-- but always with the same timestamp (logs only go to the nearest second) so that doesn't give me any information. My site's logs can get a bit hiccupy; I've found things out of alignment by up to five seconds, so I'm not going to make any conjectures when it's the same second.

In spite of the four-week gap, they again requested nothing but the html and the two icons. This is good for me, since the page in question has zillions of supporting files-- so many that an ordinary human request tends to wind up with a clutch of 503s when they exceed the server's quota on simultaneous requests.

So I'm still wondering if it's akin to FF's favicon reloader, with the preliminary step (which Firefox doesn't do) of first getting the page itself. A full GET, not just a HEAD.

[keyplyr]

Bookmark link checker from user with dynamic IP at the ISP?

[lucy24]

Bookmark link checker

That's what I keep wondering too. Firefox's version, if you're not familiar with it, periodically re-loads the favicon belonging to everything you've got bookmarked. No page, just the favicon. Personally I think this is A Good Thing, because bookmarks with favicons next to them look more appealing, so people are more likely to re-visit.