I have a system that sends bulk emails via Sendgrid. Each email has a personalised unsubscribe link that is handled by a server in our organisation (i.e. not using Sendgrid's unsubscribe feature.) The link includes a customer ID and a hashed token to validate it. This works fine, but I'm seeing in the logs some callbacks to the /unsubscribe
url with a completely different token, e.g. I'm expecting (and getting) callbacks like:
/unsubscribe/1322454:4e549e16fbcf022d0335ab34c8d7764f4885c6e827d4647
But I'm also seeing a handful of callbacks like this:
/unsubscribe/NjUwNzU6Y2
The interesting thing is that all these are originating from IP addresses owned by Microsoft (in the 20.0.0.0 and 40.0.0.0 ranges.) They appear to occur immediately after mail delivery which suggests they are an automated response, though the same IPs also make a matching call to /favicon.ico which suggests they originate from a browser.
It's not a big deal (the calls just get ignored) but I'm curious as to what is generating these. The tokens all start with N and bear no resemblance to any other data I can find (i.e. not matching message IDs or SMTP delivery responses.)