I host some simple services for my own use on a commercial shared hosting server. These URLs are cryptic and not easily guessed, and the query strings tend to be long and cryptic. The web services are hit automatically (sometimes manually) numerous times per day, from either my premises or from cron jobs on the host (I mention this mainly illustrate that there would be a potentially large volume of encrypted queries to analyze). I switched my hosting to HTTPS-only about two years ago, so all website paths and queries should be end-to-end encrypted, with only the domain name leaking.
Sometimes these URLs are sent in the body of email to me, invoked from within the service script and using an email account at the hosting company (using the same domain as the script for the email address, fwiw), sent using secure email.
My incoming email provider (a large tech company that offers email accounts) is also using secure email in transit to me.
Email is often not encrypted at rest on mail servers from what I understand, so could potentially be available to employees at either my sender (hosting / email) provider, or my receiving email provider.
Recently, I have seen a small number of hits to my web services from unknown IP addresses, and client HTTP characteristics that aren't me. The odd thing is that they use the correct full path of the URL, but the queries are oddly distorted: they have the correct number of terms, key lengths, and value lengths, but the key names and key values are gibberish.
For example, if my correct URL for a query is: https://example.com/obscurepathname/obscurescriptname.html?qwerty=3141&a=STACKEXCHANGE&qqw=poiuyt
...the probing URL could be: https://example.com/obscurepathname/obscurescriptname.html?dvorak=5926&y=MNBVCXZASDFGH&cvb=sdfgh
I've checked all the permissions on my shared server. I don't believe another user on that server can be accessing my files. A hosting company support employee could however, or someone who has infiltrated the hosting company at some level, either hosting or email. I've seen no other indication of breach at my premises or at the hosting or email providers.
Given that the URLs originate from a couple of different locations, but pass through the same email path would favor the breach being email and not hosting or my premises.
It seems to me that either someone can partially sniff my full URLs, and determine query structure but not content. Or that they can sniff the full URL with query but choose to probe with alternate query keys and values. I don't see any 404s that would indicate probing of other non-existent pathnames or incorrect query structures.
Is this pattern of probing my web site something others have seen, and if so, what is the purpose of mangling the queries or what is the limitation in fully observing the query terms if the full path can be observed?
What seems like the most likely avenue for the breach, from among those I've outlined above, or from another I haven't thought of?
P.S. This question seems more like security than webmaster to me, and includes elements of hosting and email, but please advise.