I have a system that sends bulk emails via Sendgrid. Each email has a personalised unsubscribe link that is handled by a server in our organisation (i.e. not using Sendgrid's unsubscribe feature.) The link includes a customer ID and a hashed token to validate it. This works fine, but I'm seeing in the logs some callbacks to the
/unsubscribe url with a completely different token, e.g. I'm expecting (and getting) callbacks like:
But I'm also seeing a handful of callbacks like this:
The interesting thing is that all these are originating from IP addresses owned by Microsoft (in the 220.127.116.11 and 18.104.22.168 ranges.) They appear to occur immediately after mail delivery which suggests they are an automated response, though the same IPs also make a matching call to /favicon.ico which suggests they originate from a browser.
It's not a big deal (the calls just get ignored) but I'm curious as to what is generating these. The tokens all start with N and bear no resemblance to any other data I can find (i.e. not matching message IDs or SMTP delivery responses.)