Getting suddenly a lot of request from CFNetwork/Darwin

Question

I've noticed in the AWS console that our website got a lot of more requests than normally. Especially in the night hours (Europe time).

Then I've checked the nginx logs and now I know that a lot of devices with different IP addresses request the root of the website, most of them with the user agent swcd (unknown version) CFNetwork/978.0.7 Darwin/18.7.0. Sometimes one of the versions is different.

I have absolutely no idea what is going on so I hope that someone can help.

Answer 1

swcd runs on iOS and macOS devices and will periodically attempt to access /apple-app-site-association and /.well-known/apple-app-site-association. This is used for several features which mediate between an Apple native app and the web, including Shared Web Credentials, Handoff, and Universal Links.

This process will typically run overnight in the user's local time zone, but specific timing is not guaranteed.

See also Setting Up an App’s Associated Domains for more information on associated domains.

Hard to guess the cause of the spike without knowing more about your product - but some possible causes:

• you recently released an update to your iOS or macOS app
• a larger customer just signed up for your service or rolled out your product to more employees
• a larger customer just deployed an iOS or macOS operating system update to their managed devices

Anyway, I would ignore the spike. If it's causing you trouble, ensure your load balancer is configured correctly.