95% of the Website Visits From Our Cold Email Were Security Scanners, Not People

The Short Answer

Over two weeks in August 2026, Google Analytics reported 194 weekly active users on this site, almost all of them arriving from a B2B cold-email sequence. Counting only users who scrolled a page — a thing people do and link scanners don't — left 8.

The other ~95% were corporate email security tools. Microsoft Defender, Proofpoint, Mimecast and their peers open every link in an inbound email in a sandboxed browser to check it for malware. That browser runs JavaScript. The analytics tag fires. Google Analytics records a visitor.

Nothing about that visitor is a person, and every website-side metric we had been using to judge the campaign — landing-page views, time on page, the conversion from our examples page to our contact page — was measuring the scanners.

The numbers below are from our own property, at the dates they were pulled, with the method spelled out so you can run the same check on yours. Where a figure is derived rather than measured, it says so.

What Google Analytics Reported

The campaign was ordinary B2B outbound: a three-touch sequence sent from a company address to prospects at software companies, each email linking to a page on this site. The links carried no UTM parameters.

For the fourteen days ending 15 August 2026, GA4 showed:

Taken at face value that is a healthy funnel for a small site. Taken at face value is how we had been taking it.

The Five Signals

No single number below proves anything. Together they leave no other explanation.

1. The referrer is missing. 89% of sessions were Direct. A person clicking a link in Outlook or Gmail usually arrives with no referrer too, so on its own this is weak. It becomes strong in combination with the rest.

2. Every session lasts the same seven to thirteen seconds. People vary. A scanner loads the page, waits for the scripts to settle, takes its screenshot and leaves. The duration was flat across the homepage, the examples page and every blog post — pages of very different length.

3. Nobody ever comes back. 94% of session starts were first visits. Real prospects who are interested return, often within the hour, from a different device, or after the follow-up email. Scanners never do, because each email is a new link to check.

4. The cities are datacenters. San Jose, Des Moines, Moses Lake, Amsterdam, Dublin, Gävle and Ashburn accounted for 155 of 246 sessions. Those are not where our prospects live. They are where Microsoft, Amazon and Google run the infrastructure that opens links on behalf of corporate mail servers.

5. Nobody scrolls. Against 421 pageviews, GA4 recorded 15 scroll events from 9 users. A scroll event fires when a visitor reaches 90% of the page. A sandboxed browser taking a screenshot has no reason to.

The Proof: URLs That Never Existed

The decisive evidence was an accident. A formatting bug in the sequence tool flattened line breaks, so some emails contained links like /examplesReal and /examples.Real — the intended path with the first word of the next sentence glued on.

Those URLs never existed on the site. They were never in a sitemap. No search engine or crawler could have discovered them. The only place they ever appeared was inside the body of an email.

GA4 recorded 23 sessions landing on them.

The only thing that follows a link which exists nowhere but inside an email is something that reads emails and follows links. That is the definition of a link scanner.

What the Filter Left

Restricting activeUsers to users who fired a scroll event, over the same windows:

The raw number swung from 84 to 306 week to week. The human number sat between 2 and 8. The raw figure tracked how many emails were sent that week; the filtered one tracked how many people read the site. They were never the same quantity.

One more number worth sitting with: the page every email pointed at, our examples page, had 52 direct sessions in fourteen days and zero users who scrolled it — ever. It was, at that point, a page only robots had seen.

How This Compares to Published Figures

This is not a new phenomenon, but the published numbers all measure it from inside email tools, and none of them is specific to cold outbound.

• M3AAWG (the Messaging, Malware and Mobile Anti-Abuse Working Group) put non-human interactions at 20–80% of B2B email clicks in its 2020 paper, noting the wide range correlated with recipient engagement and reputation. The paper also notes its underlying data was not published.
• Omnivery's 2026 State of Email Bots report puts corporate security scanners at 80–95% of links on corporate domains, and bot clicks across its ESP traffic crossing 50% in mid-2026.
• Individual senders have published campaign-level figures — 63% (Inbox Collective, 2023 newsletter data) and 71% (Kick Point, one client, 2026).

Ours differs in what it counts. Those figures are the share of clicks an email tool recorded. Ours is the share of sessions the website recorded — what actually lands in Google Analytics and drives the dashboards downstream. To our knowledge that denominator has not been published for cold outbound before. The result is consistent with M3AAWG's ceiling and Omnivery's corporate figure, measured from the other end.

Check Your Own Account in Ten Minutes

Every one of these is a standard GA4 report or a two-line Data API query. No add-ons.

1. Pull weekly active users twice — once unfiltered, once with the dimension filter eventName = scroll. The gap between them is your scanner share. This is the single most useful number and it is retroactive; you can run it on last quarter.
2. Look at first_visit ÷ session_start. Above 85% on a campaign that runs follow-ups, something is wrong.
3. Break sessions down by city. If Ashburn, Des Moines, Moses Lake, Dublin or Amsterdam are in your top ten and you do not sell there, that is Azure, AWS and Google.
4. Plot session duration for the landing page. A person's distribution has a long tail. A scanner's is a spike.
5. Plant a canary. Put a link in your next sequence to a URL that exists nowhere else, and watch who visits it. Anything that arrives is not a person.

If you want a permanent fix rather than a check: report engagement-gated users as the headline, define "engaged" as having scrolled or spent 30 seconds, and treat the raw count as a proxy for send volume. That is what we did.

What Changed for Us

Everything we had computed on the raw traffic went into a corrections file. The examples-to-contact conversion rate — 11% — was scanner arithmetic. The landing-page engagement we had been iterating on was the behaviour of a headless browser. The week-over-week growth was our sequence tool's send schedule.

The honest numbers were smaller and more useful. Reply rate and booked meetings — which a scanner cannot fake — became the campaign metrics. Website analytics went back to measuring the website, once the filter was in place.

None of this means the email did not work. It means we had been grading it with the wrong instrument, and so, if the published ranges above are anywhere close, has almost everyone else.

Method Notes

• Property: a GA4 property on a single Next.js site, tag installed via the standard Google tag, no consent gating that would suppress events.
• Windows are as stated; GA4 reports were pulled with the Data API using activeUsers and sessions, and the filtered figures use a dimension filter on eventName equal to scroll.
• "Datacenter metro" is a judgement from the city dimension against the published regions of the three major cloud providers, not an IP lookup.
• The canary URLs were not planted deliberately; they were a formatting fault in the sequence tool that we noticed after the fact. The finding is the same either way.
• The mechanism is documented by the vendors themselves: Microsoft's Safe Links documentation describes URL detonation for Defender for Office 365, and Proofpoint's URL Defense rewrites and pre-checks links in the same way.