2

I received a notice from my third-party firewall application (Little Snitch) that when I had Facebook open, my browser (Chrome 46.0.2490.80 on El Capitan 10.11.1) was attempting to connect to "scontent.fper1-1.fna.fbcdn.net" and "scontent.fmel1-1.fna.fbcdn.net". Having never seen these particular variations on the fbcdn domain before despite daily use of Facebook and having used LS for a while, it was a little suspicious to me.

Looking up the IP addresses (150.101.84.17 and 150.101.84.145 respectively) point to Internode, an ISP located in Adelaide, Australia (I live in Australia, but not Adelaide) and AFAIK, Facebook does not use their CDN and I don't think Internode even provides such services.

But the domain is fbcdn.net. right? And if that's so, which is legit domain used by Facebook for content/cookies etc, even if the IP addresses don't resolve to Facebook or Akamai, it should be fine? Nothing suspicious?

1

A google search should show that scontent.fper1-1.fna.fbcdn.net type URLS are associated with Facebook photos

https://www.google.com/?q="scontent.fper1-1.fna.fbcdn.net" https://www.pinterest.com/source/scontent.fper1-1.fna.fbcdn.net/ https://www.eff.org/https-everywhere/atlas/domains/fbcdn.net.html

You can also check the cert information in your browser

Cert

There are quite more than a few variations under fbcdn.net In the end there isn't a way to say for sure without brute force listing the IPs for Facebook to compare, but in general most if not all subdomains under fbcdn.net should be safe. Facebook probably just routed you to the best server for your conditions at that point in time.

If you think otherwise you can always send a report to https://facebook.com/whitehat/report

1

Actually I am seeing similar behavior causing traffic to fluctuate for Facebook from AKAMAI CDN to the international links .

This happened since a while , and apparently the issue is caused by the referral links of the photos and videos which are pointing directly to fbcdn.net

below is the referral link:
scontent-frt3-1.xx.fbcdn.net

0

As per my knowledge Facebook doesn't use any other CDN apart from Akamai. Browser attempt should be something like this: sphotos.ak.fbcdn.net, scontent.ak.fbcdn.net. So I don't think it is fine. It might be suspicious. Sometime its good to block third party cookies.

  • I did block it, and I haven't received any other alerts about that fbcdn variation attempting to connect. Given that it potentially could just be a tracking cookie of some sort, I should be fine if I block it every time, right? Also, FB does have some other legit variations on the fbcdn domain/hostname, such as "scontent-lax3-1.xx.fbcdn.net" and "fbcdn-sphotos-h-a.akamaihd.net" (I know because I can't see content on my page when I block them but when I enable them I can see it again), but I'm pretty sure those resolve to Akamai/Facebook IP addresses. So I'm not sure what to think! – oats58459 Oct 27 '15 at 9:46
0

Facebook CDN => FNA Server => *.fbcdn.net Akamai CDN => *.akamaihd.net

Big ISP receive FNA servers.

ISP need 1Gbps with Facebook direct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.