Answers.Body: <p>This is a problem, and your analysis seems to be correct</p>
  
  <p>As this article suggest, another (more robust) option would be to track who clicks on all links, including hidden ones, and automatically remove the clicks from this user.</p>
  
  <p><a href="https://wordtothewise.com/2013/07/barracuda-filters-clicking-all-links/" rel="nofollow noreferrer">https://wordtothewise.com/2013/07/barracuda-filters-clicking-all-links/</a></p>
  
  <p>X+</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-10T15:36:21.783Z
Answers.Text: I like the stealth link approach.
Answers.UserDisplayName: Jamie
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-07T22:16:51.343Z
Answers.LastActivityDate: 2017-03-07T22:16:51.343Z
Answers.UserDisplayName: Xavier
Answers.Body: <p>One approach might be to write an extension which observes the "open" request and intercepts writing to the CiviMail open tracking table if it identifies the origin as being one of those source IPs you've identified.</p>
  
  <p>Since malware / phishing authors can (will!) undertake a similar tactic to evade detection, I'd expect Barracuda to modify their source IPs to evade detection by malware authors ... This might not be a good battle to get caught in!</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-07T19:17:44.163Z
Answers.LastActivityDate: 2017-03-07T19:17:44.163Z
Answers.UserDisplayName: Chris Burgess
Body: <p>I investigated our web logs because one of our organizations reported what seemed like strangely inflated click through numbers, including a lot of click throughs reported the very minute the message was sent.</p>
  
  <p>The web logs confirmed the statistics that CiviCRM had in the mailing report.</p>
  
  <p>However, I noticed that many of the IP addresses looked like they were coming from the same block. A whois search revealed that they were all IP addresses that belonged to the Anti-virus vendor Barracuda.</p>
  
  <p>I can't be 100% sure, but it looks to me like many of the recipients may be using Barracuda software, which may be automatically reading the messages and then "clicking" through all links in the messages to ensure they don't go to any phishing sites. </p>
  
  <p>If this theory is correct, then we may be saying good bye to click throughs as a useful metric, which is a shame since "opens" are also pretty worthless (although barracuda does not seem to be downloading the open img).</p>
  
  <p>Any suggestions on how to avoid this problem? We could exclude barracuda IP addresses but that seems like a losing battle if this approach becomes widespread.</p>
  
Tags: <civimail><click-through>
Title: CiviMail click through inflation
ThreadText: # CiviMail click through inflation
  
  (Asked by: username_0 on 2017-03-07)
  
  I investigated our web logs because one of our organizations reported what seemed like strangely inflated click through numbers, including a lot of click throughs reported the very minute the message was sent.
  
  The web logs confirmed the statistics that CiviCRM had in the mailing report.
  
  However, I noticed that many of the IP addresses looked like they were coming from the same block. A whois search revealed that they were all IP addresses that belonged to the Anti-virus vendor Barracuda.
  
  I can't be 100% sure, but it looks to me like many of the recipients may be using Barracuda software, which may be automatically reading the messages and then "clicking" through all links in the messages to ensure they don't go to any phishing sites.
  
  If this theory is correct, then we may be saying good bye to click throughs as a useful metric, which is a shame since "opens" are also pretty worthless (although barracuda does not seem to be downloading the open img).
  
  Any suggestions on how to avoid this problem? We could exclude barracuda IP addresses but that seems like a losing battle if this approach becomes widespread.
  
  **Tags:** civimail, click-through
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2017-03-07. Score: 3
  
  This is a problem, and your analysis seems to be correct
  
  As this article suggest, another (more robust) option would be to track who clicks on all links, including hidden ones, and automatically remove the clicks from this user.
  
  <https://wordtothewise.com/2013/07/barracuda-filters-clicking-all-links/>
  
  X+
  
  > **Comments:**
  > **username_0**: I like the stealth link approach.  
  
  ---
  
  ### Answer by username_2 on 2017-03-07. Score: 1
  
  One approach might be to write an extension which observes the "open" request and intercepts writing to the CiviMail open tracking table if it identifies the origin as being one of those source IPs you've identified.
  
  Since malware / phishing authors can (will!) undertake a similar tactic to evade detection, I'd expect Barracuda to modify their source IPs to evade detection by malware authors ... This might not be a good battle to get caught in!
  
  
  ---
  
  