Menu
EN
ENPLDEESFRPTIT
Log in Coming soon Start for €1 + VAT Coming soon

Are bot clicks inflating my click rate, and how do I filter scanner clicks?

Often, yes: company security filters open links to check them, and a simple counter shows that as a click. HawkOpen rates each click with named rules and separates scanner clicks from likely human ones, without any setup; scanner clicks never trigger a notification.

Checked:

Signs of a scanner include three or more links clicked within two seconds (R-CLK-BURST), a click from a security vendor’s network (R-CLK-VENDOR), from a cloud or hosting network (R-CLK-CLOUD, R-CLK-HOSTING), from a browser without a window (R-CLK-HEADLESS) or an automated one (R-CLK-WEBDRIVER), and a click within seconds of delivery (R-CLK-DELTA). A click from a data-centre network is never classified as likely human activity.

Signs of human activity include the page running in a visible browser tab (R-CLK-JS), a home or mobile network (R-CLK-RESID) and a click well after delivery (R-CLK-LATE). Even then the verdict is at most “likely”. The rules are versioned, so stored clicks can be classified again when they improve.

Sources

Related questions

More in this topic

  • What is link tracking, and how is a tracking link made or removed?

    A tracking link sends the reader through a short address that records the click and then opens the real page. In HawkOpen you do not make them by hand: in a copy tracked for links, every https link is converted automatically; in any other copy, links stay unchanged.

  • Does HawkOpen recognise link previews and AI assistants?

    Yes, when they identify themselves. A request from a link-preview bot (as in chat apps) or a declared AI agent gets the category link preview, with rules such as R-CLK-PREVIEW and R-CLK-AI-DECLARED, and is never classified as human activity.

  • Can I track clicks on links inside a PDF?

    No. HawkOpen tracks links in the body of the email, not inside a PDF. For a PDF shared as a HawkOpen link it records sessions and time per page once the recipient agrees to it on the PDF page; file sharing waits for the malware-scanning service, which is not switched on yet.

  • Which security scanners cause false clicks, and does HawkOpen recognise Proofpoint, Mimecast, Barracuda or Safe Links?

    Gateways like these check links in incoming mail and can click every one of them. HawkOpen recognises them by where the request comes from (known security-vendor and data-centre networks) and by how it behaves, and marks such clicks as security scanner.

  • How does HawkOpen detect headless browsers and bots?

    With named rules: a browser that reports itself as headless (R-CLK-HEADLESS), one controlled by automation (R-CLK-WEBDRIVER), a request without a language header (R-CLK-NOLANG), and a program that claims to be a modern browser but does not behave like one (R-CLK-NOFETCH).

  • Does HawkOpen use hidden “honey” links to expose scanners?

    Not today. The rules have codes for such links (R-CLK-HONEY), but HawkOpen does not add hidden links to the emails it sends. It recognises scanners by their network and behaviour instead.

  • Why do the links in my sent emails look different or get rewritten?

    Two things can change them. In a copy tracked for links (your company switched link tracking on and the recipient’s consent is recorded), HawkOpen turns each https link into a short HawkOpen address that records the click and forwards to the page. On the recipient’s side, a security gateway such as Microsoft Safe Links may wrap that link again to check it before the click.

  • Can I track clicks on links in my signature?

    Yes, if the signature is part of the message HawkOpen sends and that copy is tracked for links: every https link in it is tracked, wherever it is. HawkOpen does not treat signature links separately, and a signature added by another program after sending is not seen.

  • Why do I see opens but no clicks?

    Most readers do not click, and some opens are not human activity at all: Apple Mail Privacy Protection, Gmail’s proxy and scanners load the image without anyone reading. Check the category of each open before you conclude the message was read.

  • Can a security scanner use up my link before the recipient clicks it?

    Not a HawkOpen tracked link: it is not single-use and forwards to the page on every request, scanners included. The scanner’s visit is recorded as a security-scanner click and the recipient’s later click works normally.

  • Do long tracking links break when a gateway wraps them?

    It can happen with very long addresses. A HawkOpen tracked link carries an encoded copy of the destination, so it is about a third longer than the original; destinations longer than 4096 bytes are left untracked. HawkOpen has not tested every gateway’s length limit.

  • What is the HawkOpen address in my links, and what does the recipient see?

    It is the short redirect that records the click. When the recipient hovers over the link, they see a HawkOpen address; when they click, HawkOpen notes the click and immediately forwards them to your original https page.

  • Why does a tracked link show an error instead of the page?

    Usually because the link address was damaged on the way, for example cut off, wrapped across lines or edited. HawkOpen then does not recognise the code in the link and answers “not found”, because it no longer knows where to send the reader.

For AI assistants: Markdown · JSON