Users may contact you to say they did not interact with your phishing simulation and question why they are listed as someone who opened the email, clicked on the link or opened the attachment in your campaign. This is something that may also appear when you are testing our product. This can be the result of false positives and may be an indication that a bot or sandbox has interacted with the email before it reached the employee. We recommend that you follow our instructions to add Phish Insight to your Allow List. However, if the false positives continue we will help you to remove these results from your reports.


Note: To add Phish Insight URL's to your Allow List, kindly sign in to your account, open the chat widget at the lower-right corner and go to Allow List > Add Phish Insight to your Allow List.


How does Phish Insight detect potential bot activities?

Once your simulation campaign is complete, we will tag potential bot activities based on the following rules:

  • A user clicks more than 3 times within 3 seconds 
  • An IP clicks on more than 2 users


What does "Hidden from results" mean?

Phish Insight hides records that we can confidently identify as a bot. We use the following rules.

  • Unusual Interaction IP (The IP clicks a hidden link in the simulation email)
  • Unusual User Agent (e.g. Java or Python) 
  • Unusual OS (e.g. Windows Vista or XP)
  • Unusual User Agent with OS (ex: using IE on Mac) 


How to review potential bot activities?

You can review these activities and determine if they are indeed bot activities or actual user activities.

  1. Go to Campaigns and click the name of your campaign.
  2. Click the Bot activities button at the upper-right corner of the page. This button gives the percentage of potential bot activities.

  3. Click Review now.

  4. Click the type of record to browse from the pie graph, select an item and take an action.
    Type of record
    Possible Actions
    Actual user activities
    Hide from results
    Bot activities
    Mark as actual user activities / Hide from results
    Hidden from results
    Mark as actual user activities

  5. Click Save results.