Odd Traffic hits on CanaryToken using HTTP CanaryDrop

Hey everyone.  

I'm quite puzzled with the recent events that have happened with my Google Apps for work account and strange CanaryToken notifications.

I use a service called CanaryTokens from canarytokens.org which allows you to generate a random string URL on a variety of channels, ie HTTP, DNS, SQL Queries, etc.  Ex, you can generate a random URL (and insert this URL as an image inside of a string of HTML code for use in an Email Signature) and if the signature is loaded, the token is triggered and sends an email notification.

Here's the scoop.

I've set up a CanaryDrop on my Google apps for Work email signature so every time I compose an email, or send an email with my Google Apps for Work Gmail Web Interface (including whichever service uses the web interface for composing emails, on any platform, ie a PC, iOS device via browser, etc), I'll get an email notification that looks similar to this:


Now, here's the strange thing.  So far I've had 2 very strange token alerts coming from an IP address in the Phillipines with a user agent stating they were using a Windows 7 system (which I do not use), and also a more recent one (exactly like the one posted above) from an IP located in Barrie, Ontario (originating from the Rogers ISP).  

I currently use TekSavvy which is a Canadian ISP that uses Rogers networks, however I do not see how it would be even possible to receive a token alert from an IP that's originating from a Rogers Network considering i never sent/received an email from the Web Interface to/from that IP address (or any for that matter) even during the time of the event.

My question is, what would this IP address be doing?  I thought Google Apps for Work is sending email using a secure SMTP protocol.  Is it possible that the mail is being intercepted or looked at?  Once again, I did not send any email during the triggered time.  Could this be a Rogers DNS server triggering it?  How can one explain the Phillipines  IP address being of a client that as triggered my email signature through Google Apps for Work?  I do know that user agents can be spoofed, but that's besides the point, the IP is the important piece of information here.  I can't seem to wrap my head around it.

I contacted Google Apps for work technical support, and they insist that there is no suspicious activity on my account.  I'm starting to believe that nothing is secure anymore, and that regardless of which ISP you're using, what security implementations you're using, the NSA and government agencies are spying on us all.

Any ideas as to what it could be?  Would love to hear your input.

Regards,

Chris