Why Your Link Was Opened Seconds After You Sent It
An open a few seconds after an email lands is almost always a security scanner, not your prospect. How to tell the two apart before you follow up.
· Written by the team that runs Track Link
Short answer
An open a few seconds after your email lands is almost always the recipient's email security checking the link, not the recipient. Services such as Microsoft Defender Safe Links, Proofpoint, Mimecast and Barracuda scan links from their own servers as mail arrives or when it is clicked. Wait for a later open, ideally from a phone or a repeat visit, before you treat it as interest.
You send a proposal at 10:02. At 10:02 the link shows an open. It feels like great news: they were waiting for it. Usually, it wasn't them. It was their company's email security checking the link before anyone had seen the message.
We see this regularly on links sent to company email addresses. Here is what causes it, what Track Link can and can't filter, and how to tell a scanner from a person before you pick up the phone.
What opens a link the moment an email lands
Most companies, schools and public bodies run security software in front of their mailboxes. Microsoft Defender for Office 365 (its link checking is called Safe Links), Proofpoint URL Defense, Mimecast, Barracuda and similar services all inspect the links in incoming email to catch phishing and malware.
How they do it depends on the vendor and on the settings each company picks, but the broad patterns are:
- Checking on delivery. The service visits the link as the email arrives, before the recipient sees it.
- Checking on click. The service checks the link again when the recipient taps it.
- Rewriting links. Some replace each link in the message with their own, so every tap passes through the vendor first.
The scan runs from the vendor's own servers, usually seconds after the email lands. To a link tracker, that's a visit. Your recipient didn't choose it, and probably doesn't know it happens.
What Track Link filters, and the gap we haven't closed
Before a click is counted, Track Link leaves out anything that identifies itself as a bot, crawler or preview in its user agent, the short text every browser sends to describe itself. Some security scanners do identify themselves. Many don't: they send an ordinary browser user agent.
For those, we also drop clicks from the major cloud-compute networks: Amazon EC2, Google Cloud, DigitalOcean, Oracle Cloud, Linode and Vultr. That catches a lot of scanners and scrapers. Why we built it is in why your link shows clicks nobody made.
Other vendors' scanners can slip through the same way when they run on a network we don't filter. So the safest assumption is simple: an open within a minute or so of sending, to a company address, is a machine until something says otherwise.
How to tell a scanner from a person
No single clue is proof. Two or three together usually are. Open the link's click log, or read the details in the alert email, and check:
| Clue | Looks like a scanner | Looks like a person |
|---|---|---|
| Timing | Seconds after you hit send | Minutes or hours later, often when they'd normally read email |
| Location | A data-centre city, or a region far from the recipient | Roughly where the recipient lives or works |
| Device and browser | Doesn't fit: a desktop browser when they read on their phone, or an unusual browser | A phone, or the kind of computer they normally use |
| Several links in one email | Every link opened within the same second | One or two links, the ones they cared about |
| What happens next | One hit, then nothing | Often comes back, sometimes more than once |
Location needs a little care. A city worked out from an IP address is approximate, and a VPN or a corporate network can place a real person somewhere else. A far-off city on its own proves nothing. A far-off city seconds after delivery, on a desktop browser, with every link in the email opened at once, is a scanner.
What to do: read the second and third rows in the click log, not just the first. The first open on a link sent to a company address is the one most likely to be a machine.
What the sequence often looks like
Put the clues together and a proposal sent to a company address might show something like this:
- An open within seconds of sending, on a desktop browser, from a city where the recipient doesn't work. If the email had three links, all three open in the same second.
- Nothing for a while.
- An open from a phone, roughly where the recipient is, on the one link they cared about.
- Maybe another open later from a laptop, when they come back to it or pass it to a colleague.
Row 1 is the scanner. Rows 3 and 4 are the person. If all you ever see is row 1, the email was delivered and checked, but there's no sign yet that anyone has read it.
Not every fast open is a machine, though. If you sent a link to someone's personal address while they were waiting for it, a quick open from a phone in their city can easily be them. The clues matter more than the clock.
Open alerts and scanner opens
Open alerts email you when someone opens a link you picked: a proposal, a deck, a contract, a CV. They're on the Agency and Business plans, with 50 alert emails a month on Agency and 200 on Business, and they're off for every link until you turn one on.
For each link you choose a rule: an email on every open, or one email every so many clicks. Each link also has an hourly cap on alert emails, so a burst of opens doesn't flood your inbox. Opens past the cap are still recorded.
Alerts use the same filters as your analytics. Previews, known bots and the major cloud networks never trigger one. A scanner on a network we don't filter can, and it uses up one of the month's alert emails like any other open.
The alert email shows when the link was opened, the city and country, the device and browser, and how many opens the link has had so far. That's enough to run the checks in the table above without opening the dashboard.
How to follow up without being fooled
- Send one link per recipient. If three people get the same link, an open tells you nothing about who. A separate link for each person means every open, and every scanner hit, belongs to one inbox.
- Wait for a second open, or a later one. A scanner usually hits once, straight away. A person tends to open later, often from a phone, and often comes back.
- Don't treat the first open as interest. If it came within seconds of sending, it tells you the email was delivered, and not much more.
- Don't mention the open in your follow-up. "I saw you opened it" is awkward when they did, and worse when it was their firewall.
- Keep your normal follow-up schedule. Use opens to time a call better, not to decide whether to call at all.
Tracking pixels are even less reliable
If you track opens with an image pixel rather than a link, the picture gets murkier. Some mail apps load images as a message arrives, before anyone reads it, so a pixel "open" can be the mail app rather than a person. We go through which apps do what in how accurate an email tracking pixel is in 2026. For a proposal or a document, a tracked link is the better signal.
See what a scanner looks like on your own setup
The quickest way to learn the pattern is to watch it once. Create a test link, email it to a work address that sits behind a security filter, and don't open the email. Then check the link's click log. Anything you see there is a machine, and now you know what one looks like: the time gap, the city, the device. Open the email yourself later and compare the two rows.
For tracked links in email generally, see how to track link clicks in email. For proposals and quotes, see proposal tracking.
Questions people ask
Why was my link clicked immediately after I sent the email?
Almost always because the recipient's email security checked it. Services such as Microsoft Defender Safe Links, Proofpoint, Mimecast and Barracuda visit links from their own servers as mail arrives, and that visit registers as an open.
Does Microsoft Safe Links click on links in emails?
It checks them. Depending on an organisation's settings, Safe Links can check a link when the email arrives and again when someone clicks it, and either check can show up in a link tracker as an open.
Can Track Link filter out Safe Links scans?
Not all of them. We filter known bot user agents and the major cloud-compute networks, but Microsoft's network isn't covered, so a Safe Links check that uses a normal browser user agent can still be recorded as an open.
Will a security scanner trigger my open alert?
It can. Open alerts, on the Agency and Business plans, skip previews, known bots and the major cloud networks, but a scanner on Microsoft's network can still trigger one. An alert seconds after delivery is most likely a scanner; the next one is usually your recipient.
How do I know when the real person opened my link?
Look for an open that comes later, from a device that fits the recipient, roughly where they are, and ideally more than once. A single hit seconds after sending with nothing after it is rarely a person.
See it on your own links
Track Link is free to start: sign in with Google or Microsoft, no credit card.