Interesting. I might have figured it out.
I think it happens when a user is viewing a "posts" URL, e.g.
https://xenforo.com/community/posts/1425706/share
View attachment 225105
And in the database (xf_session_activity):
View attachment 225106
If you run this query, what are the results that you get?
SQL:
SELECT controller_name, controller_action, params
FROM xf_session_activity
WHERE controller_name = 'XF\\Pub\\Controller\\Post'
I assume this will find a bunch and the
controller_action
will be
Share
or similar?