Going through our application logs recently I noticed a number of instances of page requests where an invalid SHA512 digest param in a URL resulted in a 403.
A couple aspects of these requests make me suspect an email scanner is checking our links for malware, as described in this answer. First, the requests tend to occur within a few minutes of the email with the link being generated. Second, the requests appear to come from the same IP range.
Whatever the source, it definitely appears automated. The changed digest gives me hope that this is a friendly email scanner trying to avoid causing problems for our application by changing the digest to prevent the request from authorizing and taking some action within the application.
Do scanners do this sort of thing? Is there any documentation of this? I’m hoping what I’m seeing is evidence of an email scanner and not something malicious.