Great stuff, thanks Mark, really appreciate the detailed reply - good to
know we're not the only ones.
Thanks also for the pointers to prevent it. In particular I love that it
always clicks "no"!
Andy
On 11/09/2026 18:40, Mark Fletcher via mailop wrote:
Andy,
We (Groups.io) see the same thing. Same /24s, including several of the
exact IPs in your list (135.232.20.13, 135.232.20.2, 135.232.19.31
...). It's about 40 hosts in 135.232.19.0/24 <http://135.232.19.0/24>
and 135.232.20.0/24 <http://135.232.20.0/24>, Azure East US
(Boydton, VA). No rDNS, RIPE just says "cloud". We haven't been able
to identify the vendor.
Here is what it looks like from our side over the past ten days
(analysis of our logs with help from Claude):
- Volume: 3,500 to 8,700 requests/day to each of our two web frontends.
Steady since at least Sept 1, so it's not a spike for us.
- It's a real headless Chrome, not a link checker. It loads the images
from digests, follows every link in a message (unsubscribe, edit
subscription, view message, attachments, account confirmation), pulls
in the page's CSS and JS, executes the JS (it fires our passkey login
probe and our bot-detection beacon), and submits forms.
- Rotating desktop UAs, no bot token: Chrome/109, 140.0.7339.0,
141.0.7390.0, 142.0.7444.x, 143, plus some Chrome/79 with Edg/79.
Windows and Mac variants.
- A tell: about a third of the confirmation links it fetched still had
"&" in the query string. It's pulling URLs out of raw HTML without
decoding entities.
- Some requests arrive with referers of link.edgepilot.com
<http://link.edgepilot.com> and
url.emailprotection.link, so it sits downstream of other vendors' link
rewriting. It's processing mail after delivery to the mailbox, not at
a gateway.
Why it doesn't unsubscribe anyone here:
- Our List-Unsubscribe URL is a GET-safe confirmation page. We only act
on an RFC 8058 POST carrying List-Unsubscribe=One-Click, and this range
has never sent one. The one-click POSTs we do get are from Yahoo,
Proton, Microsoft's Outlook service and Apple Mail, as you'd expect.
- The footer link goes to the same confirmation page, which has Yes / No
/ switch-to-digest buttons. The sandbox submitted that form 38 times in
ten days and pressed "No" every single time. Of all the
confirmed unsubscribes we process a day, zero come from this range.
Hope this helps.
Mark
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
--
Andy Beverley
/CEO/
Simplelists Ltd
https://www.simplelists.com/
T: +44(0) 3333 409301
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
