Why is Xcodes pinging my natural gas provider?

[steveriggins]

I logged into Xcodes with my apple id tonight and Little Snitch started asking for permission to hit a fair number of domains that are in no way, shape or form connected to Xcode nor Apple.

To Reproduce
Install Little Snitch, launch Xcodes, sign in to Apple ID, and begin installing the most recent Xcode.

Expected behavior
Only Apple domains to be pinged.

Screenshots

Version

• OS: 15.2 Beta (24C5079e)
• Xcodes: 2.2.0 (27)

[trvsdnn]

Same here... pretty odd. Explanation needed.

[MattKiazyk]

That's not Xcodes. You can look all over the codebase and nowhere does it go to outside apple endpoints.

[steveriggins]

What about any libraries it uses? The firewall caught this access from the Xcodes process.

[trvsdnn]

It's triggered by the signin popup.

[MattKiazyk]

Since Xcodes does use a URLSession.shared for network calls, perhaps there is something there that is causing it. I'm assuming that point in Safari you have visited that site? If not, I really don't know.

We don't use many shared libraries - but my question would be why specifically a utility company?

[trvsdnn]

It appears to be cycling through history and pulling urls from there. If I deny it cycles to the next domain/URL, and it hasn't stopped... i've denied 15 maybe. They're also not favorites or recents even, some I haven't visited in a long time.

It's odd for sure – I've been using little snitch for a long time and I've never seen the alerts cycle through browser/cookie/maybe login history like this before. The info panel seems to point to it's something in the WebKit framework, but I've never seen this before.

Maybe this helps: