CiviMail click through inflation

Question

I investigated our web logs because one of our organizations reported what seemed like strangely inflated click through numbers, including a lot of click throughs reported the very minute the message was sent.

The web logs confirmed the statistics that CiviCRM had in the mailing report.

However, I noticed that many of the IP addresses looked like they were coming from the same block. A whois search revealed that they were all IP addresses that belonged to the Anti-virus vendor Barracuda.

I can't be 100% sure, but it looks to me like many of the recipients may be using Barracuda software, which may be automatically reading the messages and then "clicking" through all links in the messages to ensure they don't go to any phishing sites.

If this theory is correct, then we may be saying good bye to click throughs as a useful metric, which is a shame since "opens" are also pretty worthless (although barracuda does not seem to be downloading the open img).

Any suggestions on how to avoid this problem? We could exclude barracuda IP addresses but that seems like a losing battle if this approach becomes widespread.

Answer 1

This is a problem, and your analysis seems to be correct

As this article suggest, another (more robust) option would be to track who clicks on all links, including hidden ones, and automatically remove the clicks from this user.

https://wordtothewise.com/2013/07/barracuda-filters-clicking-all-links/

X+

Answer 2

One approach might be to write an extension which observes the "open" request and intercepts writing to the CiviMail open tracking table if it identifies the origin as being one of those source IPs you've identified.

Since malware / phishing authors can (will!) undertake a similar tactic to evade detection, I'd expect Barracuda to modify their source IPs to evade detection by malware authors ... This might not be a good battle to get caught in!