We've came across a strange user-agent string in our server logs. A browser (pretending to be an iOS Safari 9.0) had WalletPasses/1.2.3
at the end of the user-agent
HTTP header.
What's that device or software?
A quick Google search reveals https://walletpasses.io. From there:
Wallet Passes allows you to use your Apple® Wallet / Passbook® Passes on Android™
So I'm guessing that they're spoofing the iOS Safari user-agent to make websites offer Apple Wallet to them.