Blog

How to filter bot clicks out of your email campaigns

A practical setup for separating real subscriber clicks from security scanner clicks, using a redirect page and one IP lookup.

If you read our post on inflated click rates, you know the problem. This is the fix. It takes an afternoon and does not need any special tooling.

The idea

Your email platform can't tell humans and scanners apart, but your own website can. So you let every click land on a page you control, check the visitor's IP there, and record the result before anything else happens.

Step 1: send links through your own site

Most email platforms already wrap links for tracking. You add one more layer: point campaign links at a small endpoint on your domain, with the campaign and subscriber ID in the URL. That endpoint logs the click and sends the visitor on to the real page.

Step 2: check the IP on arrival

When the request comes in, ask Fraudex about the visitor's IP:

GET https://fraudex.xyz/api/check?ip=VISITOR_IP
X-API-Key: fx_your_key

The response tells you which network the IP belongs to and whether it is a datacenter, VPN, proxy or bot network (is_bot). Security scanners almost always run from cloud infrastructure, so they come back flagged. Your subscribers, reading on their phone or laptop, come back clean.

Step 3: record, don't block

Save the verdict next to the click: human or automated. Then send everyone to the same destination page. Same content, same speed, no tricks.

This part is important. If you start showing different content to scanners, you are doing what phishing pages do, and the scanners are built to catch exactly that.

Step 4: use the clean numbers

  • Report click-through rate on human clicks only.
  • Trigger follow-up automations only on human clicks.
  • Score leads using human clicks only.
  • Keep the automated clicks in a separate column so you can see how much of your list sits behind corporate security.

A note on timing

You can sharpen the result by adding timing. A click that arrives less than a few seconds after delivery, from a flagged network, is almost certainly automated. A click from a clean home network an hour later is almost certainly a person.

Once this is in place, your campaign reports usually drop a little and get a lot more useful. Fewer clicks, but every one of them is someone who actually wanted to read more.