favicon.ico access

There's a Firefox addon called, I think, Favicon Reloader. When a user has bookmarked a page, FF periodically stops by--with the user's IP and current UA--and picks up a fresh copy of the favicon. This favicon then shows up on the bookmarks bar/menu instead of the generic icon.

In my opinion, this is A Good Thing. The requests take up only a tiny amount of bandwidth, and it makes your site more attractive to repeat visitors (i.e. they're more likely to return, which presumably you want them to do). Look up at your own Bookmarks menu and notice how the ones with individual icons stand out.

Lucy's explanation is likely correct. If this is bothersome, you could always include .ico in your caching schema to see if that stops it.

I am not bothered by these in the normal sense of the word. I am studying these web requests to understand the reasoning/mechanisms behind them. It just feels a bit odd some people are that keen in getting an updated .ico when generally speaking these images hardly ever change. So I am thinking there could be other reasons behind it, such as to induce me to search/whois their addresses. I presume they may have a way to get my private IP address that way. The reason for that possibility is the software product I am selling on my website was subject to a hacking attempt that the attacker failed. So they might want to get round the problem by accessing my PC for the source code, maybe.

Let's assume these favicon requests are perfectly innocent, and supported by a normal firefox capability, I am not aware of similar capability for chome-like UA. What feature produced the following requests ? As you can see this guy needs my favicon pretty bad. He's a russian. I had a russian commentor a couple of days ago for one of my youtube product videos. The comment was about nothing but he's looking to make contact - again the reason could be for my IP address.

access_log: ip.ip.ip.ip 07/Feb/2017:02:09:41 "/favicon.ico" 304 - "(Windows 10.
0; WOW64) Chrome Vivaldi/1.6.689.40"
03:16:14 "/favicon.ico" 304 - "(Windows 10.0; WOW64) Chrome Vivaldi/1.6.689.40"
08:16:14 "/favicon.ico" 304 - "(Windows 10.0; WOW64) Chrome Vivaldi/1.6.689.40"
11:27:09 "/favicon.ico" 304 - "(Windows 10.0; WOW64) Chrome Vivaldi/1.6.689.40"
12:13:01 "/favicon.ico" 304 - "(Windows 10.0; WOW64) Chrome Vivaldi/1.6.689.40"
12:15:21 "/favicon.ico" 304 - "(Windows 10.0; WOW64) Chrome Vivaldi/1.6.689.40"
17:44:58 "/favicon.ico" 304 - "(Windows 10.0; WOW64) Chrome Vivaldi/1.6.689.40"
17:53:43 "/favicon.ico" 304 - "(Windows 10.0; WOW64) Chrome Vivaldi/1.6.689.40"

It just feels a bit odd some people are that keen in getting an updated .ico

And what we're saying is, it is not "people" it's a feature of the browser which may be triggered by your caching schema.

Do you use nocache anywhere? Are you not setting caching in your headers? Example:

Header set Cache-Control "max-age=2592000"

That sets caching for 30 days for all files. There are also several methods of caching selected file types: [varvy.com...]

Yes, I set no caching for all requests. Hence the 304's. It's not that I don't want these requests. Rather they are unusual, stick out, and appear to be trolling for a response that I will not give. I am interested how these requests are generated so that I can better assess the people behind them.

In any case, neither of these individuals are potential customers. I have other customers and interested people. Some of them would have added my site to their favourites but none of them generate these excessive .ico-only requests. I had plenty of people who kept my site in one of their browser tabs. They usually pull the entire page rather than just the .ico. This is what makes the these ico requests odd for me.

[edited by: NoobOperator at 1:03 am (utc) on Feb 9, 2017]

Incidentally, did you notice all those 304 responses? That means your server isn't even sending out the favicon; it's saying "look, doofus, it's exactly the same as the last time you asked ... and the time before ... and the time before that again". This, in turn, means that for most server configurations, the server is already doing less work that it would take to evaluate the request and return a 403.

Edit: But, as keyplyr said, make sure your favicon has a long, long caching time. That's the most practical action you can take.

@lucy24 yes, the 304's are by design.The puzzle I am trying to work out is why nobody else generates these ico-only requests but these 2 people, both of whom are on my mental suspicion list ?

Given vivaldi is bit of a niche browser, I guess no one but myself can answer my question. Well, I dug up logs of all previous visitors using the same browser and version. None of them exhibited this ico retrieval pattern. I also installed vivaldi myself. Essentially it's a chrome variant that handles the ico in the same way - rather involved.

The gist of it is that it's not possible for normal chrome or vivaldi to produce the the logged ico access pattern. So the russian in question is using an extra special version of vivaldi for whatever purpose he had in mind. Now that I can see where he's coming from, I will just ignore him and see what other tricks he has up his sleeve. Youtube comment "attack", check. Ico "attack", check. I am not convinced he has other options.