I have a system that sends bulk emails via Sendgrid. Each email has a personalised unsubscribe link that is handled by a server in our organisation (i.e. not using Sendgrid's unsubscribe feature.) The link includes a customer ID and a hashed token to validate it. This works fine, but I'm seeing in the logs some callbacks to the /unsubscribe url with a completely different token, e.g. I'm expecting (and getting) callbacks like:


But I'm also seeing a handful of callbacks like this:


The interesting thing is that all these are originating from IP addresses owned by Microsoft (in the and ranges.) They appear to occur immediately after mail delivery which suggests they are an automated response, though the same IPs also make a matching call to /favicon.ico which suggests they originate from a browser.

It's not a big deal (the calls just get ignored) but I'm curious as to what is generating these. The tokens all start with N and bear no resemblance to any other data I can find (i.e. not matching message IDs or SMTP delivery responses.)

1 Answer 1


My guess would be that it is associated with Microsoft's spam email filters - ensuring that outbound links in the email are not malicious.

It is clever enough to deduce that this is an "unsubscribe" link with a unique token and so substitutes the real "token" for a benign alternative just to check the response.

  • Hmm, that's a plausible theory.
    – Clyde
    Nov 19, 2020 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.