Strange callbacks to /unsubscribe url

Question

I have a system that sends bulk emails via Sendgrid. Each email has a personalised unsubscribe link that is handled by a server in our organisation (i.e. not using Sendgrid's unsubscribe feature.) The link includes a customer ID and a hashed token to validate it. This works fine, but I'm seeing in the logs some callbacks to the /unsubscribe url with a completely different token, e.g. I'm expecting (and getting) callbacks like:

/unsubscribe/1322454:4e549e16fbcf022d0335ab34c8d7764f4885c6e827d4647

But I'm also seeing a handful of callbacks like this:

/unsubscribe/NjUwNzU6Y2

The interesting thing is that all these are originating from IP addresses owned by Microsoft (in the 20.0.0.0 and 40.0.0.0 ranges.) They appear to occur immediately after mail delivery which suggests they are an automated response, though the same IPs also make a matching call to /favicon.ico which suggests they originate from a browser.

It's not a big deal (the calls just get ignored) but I'm curious as to what is generating these. The tokens all start with N and bear no resemblance to any other data I can find (i.e. not matching message IDs or SMTP delivery responses.)

Answer 1

My guess would be that it is associated with Microsoft's spam email filters - ensuring that outbound links in the email are not malicious.

It is clever enough to deduce that this is an "unsubscribe" link with a unique token and so substitutes the real "token" for a benign alternative just to check the response.