Strange email engagement from business email domains

[mollywalker-2203]

Hi,

I'm seeing some unexpected behaviour on emails sent to people with a business email domain. Emails with a business domain are completing numerous actions on an email at the exact same time. For example, the recipient is opening, clicking, unsubscribing, opening the mirror page all at the exact same second, often immediately after they have received the email and each action is performed 3-5 times at the exact same time. It doesn't look like these are bots as they are emails connected to legitimate business domains, so I'm wondering if there is some configuration on the inboxes of these recipients where before receiving the email the emails are being screened for content and it's showing on my email tracking that these actions have been completed.

Does anyone know if this type of inbox configuration is possible or has any alternative reasons this might be happening to business email addresses only?

[Craig_Thonis · Accepted solution]

Hi Molly,

This type of activity is often due to anti-virus programs that incorporate email scanning which goes through and literally "scans" by clicking on the content. This is not a unique thing to Campaign either and you can perform a web search and find articles noting this as a common problem that causes inflated opens/clicks.

Craig

[Manoj_Kumar_]

Hello @mollywalker-2203 

Almost all enterprises use email scanning suites like Proofpoint or Mimecast to enhance their email security. These tools try to open your email and click on every available link to detect possible spam or phishing attack. All these happen even before the email lands in the actual recipient's inbox.

That is why you are seeing high number of opens/clicks on business email address only.

[shaohong]

@Manoj_Kumar_ answered exactly what happened.
We did similar investigation a year ago. One way to tell surely those behavior were done by "bots" is by checking the 'user-agent' header as well as checking a few business emails from different companies/domains. There is zero chance that 3 customers from 3 different companies, all running their email clients from a Mac then a Windows 10 and then a Windows 11 machine all around the same time and somehow from the same group of client IPs. The only explanation is some enterprise email security service at work.

Shaohong