Was That Open an Email Scanner? How to Tell a Scan From a Reader

If you want to check your own opens instead of guessing, share the document as a tracked link: start free. Every session then shows whether a page was read and for how long, which is the first sign below.

Why does a scanner open your link before the recipient does? It checks links on delivery

A scanner opens your link first because checking links is its job. Company mail runs through a security layer that looks at every URL in an inbound message for phishing and malware. To judge a page, the layer requests it, and to anything counting requests that looks like an open. Microsoft states the timing in its documentation for Safe Links, the link check in Defender for Office 365:

“As long as Safe Links protection is turned on, URLs are scanned prior to message delivery, regardless of whether the URLs are rewritten or not. If rewriting is enabled, links are scanned on click.”

Two moments follow from that. The first check happens before the message lands, so the open can arrive seconds after you press send, while your recipient hasn't seen the email yet. The second happens when the recipient clicks a rewritten link, so a check can sit just ahead of a real visit. Mimecast describes the same job on its email-security page, protection that “scans every email, attachment and URL”, with “on-click protection”. We quote Microsoft at length because its documentation states the timing in plain words.

Chat apps can add a third source: an app that shows a preview card for a pasted link has to fetch the link to build it. That is not a mail scanner, but it can leave a similar trace, and PDFTrackr's user-agent list names several link previewers.

Sign 1: no page was ever read. The strongest of the three

The strongest sign is a session in which the link opened and no page ever registered. A scanner requests the link and judges what comes back; it has no reason to sit on page three of your proposal. PDFTrackr flags a session that opened and recorded no page, unless the visit left one of three marks: the viewer's closing signal reporting at least ten seconds on the way out, a document that finished loading in the browser, or an email typed into the link's email gate. A closing signal under ten seconds doesn't count. Without one of those marks, the missing page is enough to keep the session out of your counts.

It is also by far the most common reason. Of the 1,561 sessions flagged in our data, 1,521 carried this flag. How large the flagged share is overall, and how it splits by the sender's email domain, is measured on how many document opens are bots or scanners.

Those three marks turn this sign into a weaker one: the session is recorded but not excluded by that fact alone. A loaded document shows the file reached a browser. A typed email shows someone filled in a form, though anyone can type an address. A single page shown for under a second is suspicious but also fits a person who clicked by mistake; it too is recorded and not treated as automated on its own.

What to look for in any tracker: a session with an open and nothing else. No pages, no time. If your tool only reports opens, you can't see this sign at all.

Sign 2: the visitor's user agent names itself. Rare, and enough on its own

Every browser request carries a user agent, a short string saying what software made it. Some automated visitors say so in it, with words like bot, crawler, spider, preview, fetch, scan or headless, or the name of a link previewer. PDFTrackr flags a session whose user agent carries one of those words, and a session with no user agent at all, on that fact alone.

In our window 51 of the 1,561 flagged sessions carried a user agent that named automation. A scanner that presents an ordinary browser user agent leaves nothing for this sign to catch.

One limit is worth stating plainly. PDFTrackr does not look up whether a request came from a cloud or datacenter network, so a scanner that renders a page while posing as a normal browser can pass as a person. Some tools do check the network; one is described further down.

Sign 3: the open came before anyone could have read the email

An open timed seconds after you pressed send, before the message could plausibly have been read, points to a check rather than a reader. So does a cluster of empty opens in the same minute. This sign is yours to judge: PDFTrackr's classifier does not use timing, because a fast reader and a scanner can arrive in the same minute.

Fast real opens do happen. In our open-timing data, a quarter of opened links had their first real open within about 24 minutes of the link being created, with sessions in the first 10 minutes already dropped as the sender checking their own link. The figures and method are in when people open a document you send. Treat a fast open as a question, then look at whether a page was read.

The click-time check adds one more pattern. A recipient behind Safe Links with rewriting on can produce a check and a real visit moments apart. A short empty session followed by one that reads several pages is that pattern, and the second session is the one to act on.

What none of these signs can do: prove a single session was a person

No sign, and no combination of them, proves what one session was. Each is a signal, not proof, and the limits run both ways.

• Zero-engagement includes people. Someone who opens the link and leaves before page one loads looks exactly like a scanner, and is flagged the same way.
• A scanner can look like a reader. One that renders pages from an ordinary-looking browser on a network we don't check passes as a person.
• The real-time email can fire on a scanner. PDFTrackr Pro's open email goes out when the link opens, before any reading exists, so it screens by user agent only, and a scanner posing as a browser can still trigger it.
• The dashboard gives you a count. It shows how many views were excluded, not a list of the sessions behind that number.
• We have not scored the classifier. We publish what it flagged, not how often it is right.

What holds up is reading behaviour. A session with several pages and real time on them is the strongest of these signs that a person was there. Whether a given kind of link can report that at all is covered in how to see if someone opened a link you sent.

How do other tracking tools describe their scanner handling? Two that document it

We read the help pages of two document tools that describe their scanner handling, and quote each as written. HummingDeck's help centre, read 30 Oct 2026, says: “HummingDeck checks request and network signals for likely automation. Known bot traffic is excluded from standard Analytics, Pipeline, Captured Leads, account metrics, and view notifications. If a likely automated session later produces real in-view interaction, it can be treated as human activity. Bot filtering reduces noise, but it cannot identify every automated request or prove that every remaining session came from an interested person.” Its activity help page, read 30 Oct 2026, adds that you can “enable Show bot sessions when you need to investigate a suspicious instant open”. Neither page, as we read it, names a plan, and the filtering page publishes no share of sessions removed.

On scanner handling itself, HummingDeck's pages describe more than we offer: a network check, known bot traffic kept out of its view notifications, and filtered sessions you can open. PDFTrackr has no network layer, its open email screens by user agent only, and its dashboard gives a count of excluded views.

Qwilr's help centre, read 22 Oct 2026, is frank about the limit: “Currently, Qwilr does not support IP address blocklisting. While we monitor these instances, it may not always be possible to suppress these automated triggers.” It does not say what share of its notifications that affects.

When Pro becomes the right choice

Everything above runs on free PDF tracking: the classifier, the excluded sessions, the per-page reading that tells a reader from a check. Opens reach free accounts in a daily digest on days with activity.

Pro changes when and how you hear. The open email arrives the moment the link opens, with the user-agent limit described above. After the visit closes, the Reading Report follows, scored on the full session, with one line per reader: pages read, time spent, the page they stopped on. A session the classifier flags gets no report, so the scanner check is done before the email reaches you. Upgrade to Pro when you are sending to several prospects a week and want each reader's pages in your inbox the day they read, instead of opening every session to decide whether it was a scanner. See what Pro includes, or open the live demo dashboard to see per-page sessions on sample data.

Keep reading: how free PDF tracking works.