8

Could anyone solve this mystery?

We have an web application that is only available to invited users. Our admin create accounts for users, and then the application sends an activation email to that person. The email contains a link for them to click in order to activate their account and then set a password. The link contains a unique reference, and once the link has been accessed once, it is no longer available.

One person reported that they received their email, but when they clicked their link, they got a 404 error - meaning their link had already been accessed. On searching the server logs, we saw a request matching their unique link many hours before they said that they'd clicked the link. In fact, the request occurred as soon as this person's activation email was sent, but before it reached our user's inbox. The WHOIS records for the IP address of the request - 70.39.157.192 - says it is server in the USA belonging to Packet Exchange, whereas our user is in the UK.

Does anyone have any ideas how this could happen? Could some sort of email-filtering program be accessing links in email messages whilst they are being routed around the web? Or could it be something more sinister?

This has only happened with this one user, many others have activated their accounts without problems.

Our emails are sent via MailGun, if this makes any difference.

Improve this question
6
  • Has it worked in the past? I ask because perhaps there is a bug in the script. – Steve Apr 14 '16 at 10:16
  • Yes, it has been working fine for a few weeks now, with around 100 users set up successfully. And we've tried setting up a few more users since we noticed the problem, and that all worked without any problems. – Andrew Battye Apr 14 '16 at 10:32
  • Does this one user use a different email provider than all the other users (for which it worked)? – unor Apr 14 '16 at 10:33
  • No, I don't think so. We set up around 20 users who all work for the company, in the same building, so I would assume that all their emails are handled by the same system. – Andrew Battye Apr 14 '16 at 10:36
  • I think your assumptions would be correct that possibly some sort of email scanner which might be scanning for bad/malware links since the scan would take place as soon as the receiving mail box gets the email and not when the user opens the email. A scanner sending a GET to the link which then kills the URL sounds plausible. – Analog Apr 14 '16 at 13:28
1

This sounds like a business mail scanner, even if they are a UK business they could be using a US based mail server. Some business grade mail scanners do a check of all links in the email to check if they appear to be dangerous before the email is routed to the end user.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.