Oh ... the UA looks like this:

[FBAN/FB4A;FBAV/251.0.0.31.111;FBBV/188827985;FBDM/{density=3.0,width=1080,height=1920};FBLC/en_US;FBRV/192128667;FBCR/Sprint;FBMF/samsung;FBBD/samsung;FBPN/com.facebook.katana;FBDV/SPH-L720T;FBSV/4.4.2;FBOP/1;FBCA/armeabi-v7a:armeabi;]

I would guess the Facebook App. "com.facebook.katana" which is present in the UA you mentioned is the official package name of the Facebook App.

[edited by: lammert at 11:47 pm (utc) on Jan 18, 2020]

Yes ... but what does it DO? :)

Probably a Facebook post where your page is mentioned with a link. Facebook has a habit to show the first image of a linked site in the Facebook post, so you might check if the first image of a page is linked to.

The FB4A;FBAV business is part of the UA string when a human arrives at your site via facebook; I always find it associated with m.facebook referers. But that starts with a page, and then the images are associated with the page. What business do they have looking at your images in isolation?

When someone shares a link to a webpage in Facebook, a lot of information is extracted from that webpage by Facebook, to display in the post. I guess their main goal is to provide so much information that the people looking at the post do not wish to jump to the external site anymore and disappear from Facebook. You can control what is displayed in Facebook by using meta property tags in the header of your site. In this specific case, the "og:image" tag can be used to tell Facebook which image to display when a page from your site is linked to. More info here: A Guide to Sharing for Webmasters [developers.facebook.com]

As the link is only to an image, not the page, fbapp has been given the 403 ... I DO allow fbexternal as that is to an actual page on my site.

I'll watch this in the future and see what happens.

Thanks!