We have some functionality in our system which sends emails to our customers, where the emails contain secure links with an embedded code.
Whilst inspecting our firewall logs I noticed something unusual. Sometimes (say 10% of cases), when I see a request with a valid code (where the code is in the url params), I see a second request 15-30 seconds later with the same code but coming from a different IP address. The codes are unique to individual users so this is strange. All of our users are in the UK, but some of these second requests are in different countries.
Even stranger, sometimes we see a third request, from the same IP as the second request, but with all the url param values replaced with the literal string "undefined". The url parameter names are maintained.
I have developed a theory around this, which is that the link is initially opened by our customer, and their email client then sends the link to some kind of security service which does some testing and inspection.
I realised that in this case, the second IP addresses would be data centre/corporate IPs, and this is the case. The first requests are always from a domestic ISP, and the second requests a few seconds later are from data centers. Examples of the second IPs are
One significant hole in my theory is this - whats the point in doing some security inspection on the url after my user has opened it?
Has anyone else seen such behaviour? Can anyone confirm or dismantle my hypothesis? What is going on here?
EDIT: All of the IPs I gave as examples are hosted in Microsoft Azure.