In-Flight Bot-Click Defense & Magic Link Shield
Corporate security scanners click email links within milliseconds of arrival, inflating CTR by up to 800% and prematurely burning single-use magic links. SadaSend transparently classifies automated crawler probes in sub-10ms without slowing down human browsing.
Interactive Bot-Click Classifier
Select a security crawler or legitimate visitor to test the sub-10ms classification engine.
{
"ok": true,
"status": 302,
"redirectLocation": "https://example.com/verify-account?token=auth_9a2f1b",
"trackingEvent": {
"id": "clk_defender-safelinks_9021",
"timestamp": "2026-11-09T16:31:47.160Z",
"is_bot": true,
"classification": "microsoft_defender_safelinks",
"threat_category": "automated_security_prefetch",
"risk_score": 98,
"action_taken": "suppress"
},
"performanceMetrics": {
"redirect_latency_ms": 6,
"classification_pipeline": "in_flight_asynchronous",
"edge_node": "sadasend_edge_frankfurt"
},
"analyticsImpact": {
"human_ctr_recorded": false,
"webhook_fired": "security.bot_probe_suppressed",
"token_consumed": false,
"note": "Probe excluded from customer CTR analytics"
}
}Detected Microsoft Defender asynchronous link prefetch probe. Returned a neutral 200 HTTP response, prevented premature token consumption, and excluded the probe from human CTR metrics.
Four Layers of In-Flight Click Protection
Engineered into our native edge router to deliver authentic human engagement metrics without impacting deliverability.
Sub-10ms Asynchronous Classification
Tracking redirects execute instantly on track.sadasend.com while request entropy, HTTP headers, and IP heuristics are evaluated in-flight without adding user friction.
Single-Use Auth & Token Deferral
Security bots frequently fetch authentication links before recipients open their email, burning one-time tokens. SadaSend defers token consumption until authentic human interaction.
Webhook Stream Tagging & DLQ
Webhook events explicitly differentiate between authentic human interaction and security crawler probes, keeping downstream CRM and analytics pipelines 100% clean.
Investor-Grade Human CTR Metrics
Eliminate 400% to 800% vanity metric inflation caused by corporate security appliances scanning every inbound message across your customer base.
SadaSend vs Legacy Transactional Mailers
Legacy mailers count automated bot probes as legitimate clicks, forcing companies to build custom heuristic scripts.
| Provider | Bot Filtering Pipeline | Single-Use Token Shield | Redirect Latency | Webhook Payload | Verdict |
|---|---|---|---|---|---|
| SadaSend | Native in-flight classifier (< 10ms) | Included ($0 floor, token deferral) | Sub-10ms transparent forward | Explicit is_bot: true / false | Built-In |
| SendGrid | None (all crawler probes counted) | None (crawlers burn tokens) | 45ms - 120ms legacy proxy | No bot metadata in webhooks | Vulnerable |
| Resend | Basic IP blocklist only | None (burns magic links) | 25ms - 60ms cloud wrapper | No scanner classification | Vulnerable |
| Postmark | Basic known user-agent regex | Manual custom code required | 20ms - 40ms | Partial metadata on select tiers | Vulnerable |
Filter Scanners in 3 Lines of Code
Listen to the verified email.clicked webhook and inspect the is_bot boolean.
Listen to verified click webhooks and filter bot traffic with strict typing.
import { createHmac, timingSafeEqual } from 'node:crypto';
import type { Request, Response } from 'express';
interface ClickEvent {
event: 'email.clicked';
id: string;
recipient: string;
url: string;
is_bot: boolean;
bot_classification?: {
scanner_family: string;
confidence: number;
action_taken: 'suppressed' | 'deferred' | 'recorded';
};
timestamp: string;
}
export function handleEmailWebhook(req: Request, res: Response) {
const payload = req.body as ClickEvent;
if (payload.event === 'email.clicked') {
if (payload.is_bot) {
// Automated scanner detected: do NOT trigger user automations
console.log(`[Bot Probe Suppressed] ${payload.bot_classification?.scanner_family} on ${payload.url}`);
return res.status(200).json({ status: 'bot_probe_acknowledged' });
}
// Authentic human click: safe to trigger onboarding workflows
console.log(`[Verified Human Click] ${payload.recipient} clicked ${payload.url}`);
triggerCustomerWelcomeSequence(payload.recipient);
}
return res.status(200).json({ ok: true });
}Frequently Asked Questions
Restore True CTR & Protect Your Magic Links
Included out-of-the-box in SadaSend Pro ($19/mo) and Scale plans with zero extra configuration. Stop letting corporate scanners corrupt your product analytics.