We've written before about bot-inflated engagement data and why a meaningful share of the opens and clicks in your recruitment email reporting don't come from candidates or clients at all. That problem hasn't gone away - if anything, the scanning and pre-loading behaviour built into modern email security has only become more aggressive. So we've just shipped a new, tougher filtering option: Super Strict.
This post explains what email bots actually are, how our existing Strict filter already deals with them, and exactly what changes with Super Strict.
Key points
- Email bots are mostly security infrastructure, not malicious actors - gateways and privacy features that open and click on a recipient's behalf.
- Kulea's Strict filter checks activity against a database of over 80,000 known bot IP addresses and user agents, and treats simultaneous activity as "first event genuine, everything after it bot."
- Super Strict removes that exception: any opens or clicks that happen simultaneously are now all treated as bot activity, with nothing in that cluster counted as genuine.
- This affects what shows up in campaign reports and lead-scoring actions - not your sending or deliverability.
What Is an Email Bot, Really?
When people hear "bot," they tend to picture something malicious - a scraper, a spammer, an attacker. In email marketing, the far more common source of bot activity is mundane and entirely legitimate: corporate security software doing its job.
Tools like Microsoft Defender for Office 365, Proofpoint and Mimecast routinely pre-click every link in an inbound email to scan it for threats before it ever reaches a human inbox. Apple's Mail Privacy Protection pre-loads the tracking pixel in every email sent to an Apple Mail user, regardless of whether that person opens it, deletes it, or never looks at it again. Some VPNs, antivirus suites and even a recipient's own employer-managed device can trigger the same behaviour.
None of this is a person engaging with your content. But to a platform that simply counts pixel loads and link clicks, automated and human activity look identical unless you go looking for the difference.
How Our Existing "Strict" Filter Already Handles This
Kulea has filtered bot activity out of campaign reporting for some time via our Strict setting, built on two layers:
- A known bot database. We maintain a list of over 80,000 IP addresses and user agents already confirmed to belong to scanning gateways, privacy tools and other non-human sources. Any open or click matching an entry on that list is flagged immediately.
- Simultaneous event detection. Beyond the known-bot list, Strict also looks for clusters of activity happening at effectively the same instant - several opens or clicks landing within the same fraction of a second, which is well outside normal human behaviour. Under Strict, the first event in that cluster is still counted as genuine engagement, on the basis that it could plausibly be a real click that simply triggered a cascade of automated follow-on activity. Everything after that first event in the cluster is treated as bot.
That's a sensible default for most agencies - it catches the overwhelming majority of bot noise while giving a real click the benefit of the doubt.
What's Different With Super Strict
Super Strict keeps the same 80,000-entry bot database, but changes how simultaneous activity is treated. Rather than assuming the first event in a cluster might be genuine, Super Strict now treats every event in that cluster - opens, clicks, or a mix of both happening at the same time - as bot activity. There's no exception made for the trigger event.
In practice, if a security gateway pre-loads a pixel and pre-clicks a link in the same pass (a very common pattern), Strict would have counted that first action as a genuine open or click. Super Strict now discounts the whole cluster.
The trade-off is straightforward: Super Strict will filter out a small number of genuine simultaneous actions from real people - for example, someone opening an email and immediately clicking a link in the same instant - but for most agencies that's a far smaller cost than the noise it removes. It's a setting for teams who want their campaign reports and lead-scoring data as clean as possible, even at the price of being slightly more conservative about borderline cases.
What This Means for Your Reports
Super Strict only affects what counts as a genuine action in your campaign reports and the actions that feed into lead scoring. It has no impact on your sending infrastructure, deliverability, or unsubscribe handling. If you switch it on, expect your reported open and click rates to drop - that's the filter working as intended, not a problem with your campaign. The numbers underneath are simply closer to what your candidates and clients are actually doing.
If you'd like to switch your account to Super Strict, or just want to talk through whether it's the right setting for how you use your reporting, get in touch with your account manager or book a slot below.
A Couple of Quick Questions We Get
What is an email bot?
An email bot, in the context of marketing automation, is any piece of automated software - a security gateway, an antivirus scanner, a privacy-protection feature - that opens emails or clicks links without a human being involved. It isn't necessarily malicious; most of it is everyday email security infrastructure doing its job.
What's the difference between Strict and Super Strict bot filtering?
Strict filtering flags activity from a database of known bot IP addresses and user agents, and treats the first event in a cluster of simultaneous activity as genuine, filtering only what follows. Super Strict goes further: any activity - opens or clicks - that happens at the same time as other activity is treated as bot behaviour in its entirety, including that first event.
Andrew Nicholson
Co-founder & CEO at Kulea. Guest lecturer in digital psychology and behavioural economics at the University of Buckingham.