This is probably not about a spider/crawler but it nonetheless could be autonomous behavior.
I get a hit to my landing page today from an MIT address. 18.31.10.X.
UA is Mozilla/5.0 (iPhone; CPU OS 14_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/29.2 Mobile/15E148 Safari/605.1.15
No referrer. Does about 1.5 minutes of browsing, all the expected files are requested, including favicon.ico. So far nothing unusual. Maybe a bit light in the extra header information compared to what I usually see. About 70 seconds after what looks like the end of the session I see 2 hits to favicon.ico from the same IP, but the UA is:
WidgetKitExtension/3120 CFNetwork/1197 Darwin/20.0.0
Then about 12 minutes after that I see another pair of hits, from a different MIT address (18.31.3.X) also just to favicon.ico, with the Widgetkit UA. About 1/2 hour later, another pair of hits from yet a different MIT address (18.31.21.X), also just to favicon.ico, also with the Widgetkit UA. An hour later, another hit to favicon from yet a different MIT address, also Widgetkit. About 1.25 hours later, 5 hits within 30 seconds to favicon from widgetkit from yet another MIT address,.
Then about 10 minutes later, a single hit to favicon, from widgetkit, but the IP is 172.58.220.X (T-Mobile, Boston).
What is widgetkit, why the focus on favicon.ico, and what can I infer about what the user is doing based on what I'm seeing here?
Is the user calling up my site each time I see this activity, but pulling my site from a local cache and the only file that I see being retrieved is favicon.ico?
Or is WidgetKit requesting favicon.ico autonomously and the user is unaware of this activity?
