Andy, We (Groups.io) see the same thing. Same /24s, including several of the exact IPs in your list (135.232.20.13, 135.232.20.2, 135.232.19.31 ...). It's about 40 hosts in 135.232.19.0/24 and 135.232.20.0/24, Azure East US (Boydton, VA). No rDNS, RIPE just says "cloud". We haven't been able to identify the vendor.
Here is what it looks like from our side over the past ten days (analysis of our logs with help from Claude): - Volume: 3,500 to 8,700 requests/day to each of our two web frontends. Steady since at least Sept 1, so it's not a spike for us. - It's a real headless Chrome, not a link checker. It loads the images from digests, follows every link in a message (unsubscribe, edit subscription, view message, attachments, account confirmation), pulls in the page's CSS and JS, executes the JS (it fires our passkey login probe and our bot-detection beacon), and submits forms. - Rotating desktop UAs, no bot token: Chrome/109, 140.0.7339.0, 141.0.7390.0, 142.0.7444.x, 143, plus some Chrome/79 with Edg/79. Windows and Mac variants. - A tell: about a third of the confirmation links it fetched still had "&" in the query string. It's pulling URLs out of raw HTML without decoding entities. - Some requests arrive with referers of link.edgepilot.com and url.emailprotection.link, so it sits downstream of other vendors' link rewriting. It's processing mail after delivery to the mailbox, not at a gateway. Why it doesn't unsubscribe anyone here: - Our List-Unsubscribe URL is a GET-safe confirmation page. We only act on an RFC 8058 POST carrying List-Unsubscribe=One-Click, and this range has never sent one. The one-click POSTs we do get are from Yahoo, Proton, Microsoft's Outlook service and Apple Mail, as you'd expect. - The footer link goes to the same confirmation page, which has Yes / No / switch-to-digest buttons. The sandbox submitted that form 38 times in ten days and pressed "No" every single time. Of all the confirmed unsubscribes we process a day, zero come from this range. Hope this helps. Mark
_______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
