Question: It appears that somebody can intercept and read emails that I send from my server, although
- I have set up 2-Factor authentification for sudo-access
- I log all logins on my server (Did not notice anything suspicious)
- Emails sent from my server are encrypted
When a user registers on my website, I send them a validation link per email in the form
At the moment the website has exactly one user, me, and when I click on the link that I have sent to myself I can see the corresponding access-log entry:
<MyIpAddress> - [26/Nov/2021:12:46:09 +0000] "GET /verify/registration?token=Zl3EgEz-...JDjjCVZY HTTP/1.1" 200 2677 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36"
However, a few hours later, an unknown IP tried to access the same resource again (a replay attack in the making?):
220.127.116.11 - - [26/Nov/2021:16:58:56 +0000] "GET /verify/registration?token=Zl3EgEz-...JDjjCVZY" 200 2677 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
I have googled for the unknown IP address and found out that it belongs to a "telecommunication company", whatever this means. Now I am trying to understand what has happened here. Assuming that it is practically impossible to guess the correct registration token on the first attempt in a GET-request, I came up with the following conclusions:
- Could it be that somebody can read the emails with the validation links that I send from my server? How do they do that? Would they not need access to my server in order to constantly monitor outgoing traffic? Even if they did monitor all my email traffic, would they not need time to crack the encryption of the emails? Can this be done in a few hours, despite me following all the best practices when I set up my postfix mail server (I am using TLS with a securely generated encryption key)?
- Could it be that some email provider scanned my emails for viruses and 'clicked' on the verification link that I had sent per email? I am using a Gmail account. This would perhaps explain why the unknown IP address belongs to a telecommunication company. However, why would Gmail scan my email hours after I have already read and opened them? This does not make sense to me.
- Could it be that my email settings are alright but perhaps I have a completely different security issue on my server? One thing I came up with and checked is that I do not cache the requests that arrive on my server, i.e., I can not see how an attacker could somehow get access to the request parameters of an earlier registration attempt.
I understand that it is difficult to give definite answers to these questions without having access to the server and its complete configuration etc., but I hope that perhaps somebody on this site can point me into some direction where I should look in order to improve the security for me and my users.