Skip to main content

Non-human interactions (bot clicks)

Non-human interactions (NHIs), often referred to as “bot clicks” or automated clicks, occur when an entity (typically an anti-spam or anti-malware filter) follows one or more links in a message to determine their safety or trustworthiness. This triggers a click to be recorded in the sender’s metrics, even though the recipient themselves never clicked the link. Here are a few things we know about NHIs and recommendations on how to address them.

  1. NHIs can come from a variety of sources. In research done across the industry, NHIs have typically been triggered by filters designed to detect spam or malware. These filters may be managed directly by a mailbox provider (Microsoft has confirmed they use NHIs as part of their toolset) or by a third party security vendor.
  2. NHIs are more common with B2B mail. In research cited by M3AAWG, it was observed that the impact of NHIs on B2C mail was around 10%, while B2B mail saw impacts of 20-80%.
  3. NHIs are more common for senders with reputation issues. Senders who often see mail routed to Spam are more likely to encounter NHIs than those who consistently reach the Inbox.
  4. Custom authentication and secure link tracking may help minimize the occurrence of NHIs. It was observed that mail with a mix of secure (HTTPS) and insecure (HTTP) tracking links saw more instances of NHIs than those with all HTTPS links. This also occurred when the link in the message body did not match the protocol of the end target of the link. For example, if a message used an HTTP link in the body that pointed to a HTTPS link tracking redirect, this was more likely to trigger NHI.

In previous discussions, vendors and providers who employ NHIs have stated a goal of making NHIs indistinguishable from human interactions. This is to prevent malicious actors from using knowledge of NHI behavior to evade detection. However, there are patterns that can be used to help identify some NHIs for reporting purposes:

  • Which links were clicked? NHIs will commonly click either every link in a message body, or only the first. This can include links hidden in a CSS stylesheet or elsewhere within the HTML code of the message. If you see non-visible links from the message being clicked, this is a strong indicator of NHI activity.
  • When did the clicks occur? Another strong indicator of NHI activity is clicks that occur within 1-2 seconds of message delivery, or multiple clicks in the same message that occur within 1-2 seconds of each other. These are not likely to be human activity and are strongly correlated with NHIs.
  • Who clicked the links? Elevated click rates from multiple recipients at the same domain may indicate a pattern of NHIs. This is especially true for B2B/corporate domains, but could also be seen for B2C recipients.
  • Where did the clicks originate? The IP address of the machine that triggered the click can often provide clues indicating the presence of NHI activity. If multiple clicks are seen to originate from the same IP or subset of IPs -- particularly for recipients at different domains -- the likelihood of those clicks being NHIs is increased.
  • What device registered the click? Because the same user-agent strings are often used by multiple recipient devices and apps, it can be difficult to pinpoint NHIs from a user-agent string alone. However, in conjunction with the other data listed here you may be able to identify a stronger correlation with NHI activity.

While each of these patterns on its own can indicate NHI activity, the strongest correlations are seen when multiple patterns are present. For senders who attempt to filter NHIs from their metrics, identifying activity that exhibits more than one of these patterns will provide a higher likelihood of accuracy and lower rate of false positives.

If you’re attempting to isolate NHIs from your reporting, it’s important to remember that 100% NHI detection isn’t feasible, and that providers can and do change behavior patterns in an attempt to obfuscate NHI activity.

You can find the full M3AAWG document on NHI here: Exploring the Impact of Nonhuman Interactions on Email Send Metrics.