Bot Clicks and Link Scanners: Cleaning Your Click Data

Security gateways click every link in every email before humans see them. How scanner traffic pollutes click metrics, breaks one-click flows, and how to filter it.

Apple's MPP taught senders that opens lie. The B2B equivalent has been quietly true for longer: clicks lie too. Corporate security gateways (Microsoft Defender for Office 365, Proofpoint, Mimecast, Barracuda and peers) fetch and often fully execute every link in every inbound message at delivery time, checking destinations for phishing before a human can be harmed by them. The result in your analytics: click events from recipients who never touched the message, conversion pixels firing on scanner visits, and, at B2B-heavy lists, click rates that can run several times the human reality. This article is about seeing through it.

Why scanners click

Modern filtering does not trust a URL's reputation at delivery time alone, because attackers arm links after delivery. So gateways do two things: detonate links in sandboxes when the message arrives, and rewrite URLs so every eventual human click routes through the vendor's checking infrastructure first. Both behaviours touch your tracking domain. The delivery-time detonation is the click you see seconds after the send with no human involved; the rewrite means even genuine clicks arrive at your servers from vendor infrastructure first, complicating naive IP-based filtering in the other direction.

What the pollution does

Three failure classes. Metrics: click rates and click-to-open ratios inflate, A/B tests resolve on scanner behaviour rather than human preference, and engagement-based segmentation promotes dead recipients whose gateway is very diligent. Automation: click-triggered journeys ("clicked pricing, send the follow-up") fire for scanners, mailing humans about interest they never showed. And state: single-use links get consumed, password reset tokens expire before the human arrives, and GET-based unsubscribe links unsubscribe people whose security software merely inspected the mail, the exact bug RFC 8058's POST requirement exists to prevent.

Filtering machine clicks

What this means for engagement policy

Between MPP inflating opens and scanners inflating clicks, the naive version of engagement-based sunsetting has lost both its inputs at B2B lists: a recipient can register opens and clicks for years after leaving the company, as long as the mailbox forwards and the gateway scans. The robust policy uses filtered clicks plus downstream evidence (site sessions, conversions, replies) and treats mailbox-only signals with suspicion proportional to the audience's corporate share. Meanwhile the same filtering logic that cleans your metrics also cleans your automations: no journey should fire on a click your classifier calls mechanical.

None of this is the security vendors misbehaving; they are protecting recipients from exactly the link-borne attacks the rest of this publication documents. The scanner traffic is the cost of mailing protected audiences, and like every measurement distortion before it, it punishes only the senders who never look underneath their numbers.