How are validation links getting triggered by a third party?

Question

Question: It appears that somebody can intercept and read emails that I send from my server, although

• I have set up 2-Factor authentification for sudo-access
• I log all logins on my server (Did not notice anything suspicious)
• Emails sent from my server are encrypted

---

More context:

When a user registers on my website, I send them a validation link per email in the form

www.myWebsite.com/verify/registration?token=<someToken>

At the moment the website has exactly one user, me, and when I click on the link that I have sent to myself I can see the corresponding access-log entry:

<MyIpAddress> - [26/Nov/2021:12:46:09 +0000] "GET /verify/registration?token=Zl3EgEz-...JDjjCVZY HTTP/1.1" 200 2677 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36"

However, a few hours later, an unknown IP tried to access the same resource again (a replay attack in the making?):

94.101.43.5 - - [26/Nov/2021:16:58:56 +0000] "GET /verify/registration?token=Zl3EgEz-...JDjjCVZY" 200 2677 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

I have googled for the unknown IP address and found out that it belongs to a "telecommunication company", whatever this means. Now I am trying to understand what has happened here. Assuming that it is practically impossible to guess the correct registration token on the first attempt in a GET-request, I came up with the following conclusions:

1. Could it be that somebody can read the emails with the validation links that I send from my server? How do they do that? Would they not need access to my server in order to constantly monitor outgoing traffic? Even if they did monitor all my email traffic, would they not need time to crack the encryption of the emails? Can this be done in a few hours, despite me following all the best practices when I set up my postfix mail server (I am using TLS with a securely generated encryption key)?
2. Could it be that some email provider scanned my emails for viruses and 'clicked' on the verification link that I had sent per email? I am using a Gmail account. This would perhaps explain why the unknown IP address belongs to a telecommunication company. However, why would Gmail scan my email hours after I have already read and opened them? This does not make sense to me.
3. Could it be that my email settings are alright but perhaps I have a completely different security issue on my server? One thing I came up with and checked is that I do not cache the requests that arrive on my server, i.e., I can not see how an attacker could somehow get access to the request parameters of an earlier registration attempt.

I understand that it is difficult to give definite answers to these questions without having access to the server and its complete configuration etc., but I hope that perhaps somebody on this site can point me into some direction where I should look in order to improve the security for me and my users.

Answer 1

This is a known behaviour in gmail, and 94.101.43.5 seems to be associated with Google.

Google probably does this to check URLs for scammyness and malware, so they can provide more reliable spam and phishing filtering to their users.

There's no way to have your e-mail hosted with Google and at the same time avoid Google reading your e-mails.

It's also worth remembering that encryption for SMTP (starttls) only encrypts the content in transit between e-mail servers. It does not hide the content while stored in queues on the mail server.