My company sends around 1M emails per month through various providers (Sendgrid etc.). One of emails we send is a "sign up" email, which contains a link for a user to finish registering their account.
This morning around 5:21am we sent a batch of around 200 to a company in CA. Within a minute our system logged 200 errors. The link in the email goes to a registration form which contains a hidden numeric ID and some other info so we can match them up to the right account. The system errored in that the ID submitted wasn't numeric.
When we looked into it, all of the errors were employee emails at the same company. So we setup some more verbose logging to catch the form submits, resent one email to one person and within 3-5 seconds we had the error and form data. Something replaced every form field - including the numeric ID and other hidden fields) with what looks like gibberish email addresses:
lrls******@mailru.com
txiat*****@walla.co.il
etc.
The only fields it interpreted were the password field and password verification fields (it didn't get verification right but did enter two non-email strings that would be good passwords)
The IPs that generated the errors all came from two companies - ColoUp in DC and ColoCrossing in Buffalo NY. While ColoCrossing appears legit, ColoUp is another story. When you dig into their services you see that a colo rack is $11,500,000 / month. Most pages are a mix of English and Arabic writing.
My question is, is this a compromised email server, or is their mail being routed through a malicious proxy, or is this some sort of hyper aggressive email filter that they have installed?