Who Opens Your Link Before Any Person Does: An App-by-App Guide

Paste a link into a chat and press send. Before your friend has even unlocked their phone, the link has usually been opened at least once. Not by a person, but by a machine that wants to build the little preview card with the title and the picture.

That first visit does no harm on its own. The trouble starts when a link shortener, an analytics tool or an ad dashboard counts it as a click. Then a link shared in five groups shows five "clicks" while nobody has tapped it yet.

We build MiniSnip, and telling these machines apart from people is a big part of how our click counting works. This guide shares what we have learned: which apps send which visitors, where those visitors come from, and how you can see it for yourself in ten minutes. Most of it isn't written down anywhere else in one place.

Four kinds of visitors that are not people

Every visit to a short link that isn't a person falls into one of four groups.

1. Preview bots. Chat apps and social networks fetch your page to read its title, description and image. They do it the moment a link is pasted or posted, and sometimes again later. WhatsApp, Telegram, iMessage, Facebook, Slack, Discord and LinkedIn all do this.

2. Security scanners. Email security systems and antivirus tools open links to check that they are safe. In many companies, every link in every incoming email can be opened by a scanner before the person sees the message.

3. Crawlers. Search engines, AI companies, SEO tools and uptime monitors visit links they find anywhere on the web. They are slower than preview bots: they arrive hours or days later, not seconds.

4. Look-alikes. Browsers that load a page in advance in case you tap it (called prefetching), link checkers that only ask "does this page exist?", and scripts that pretend to be a normal browser.

None of these is a person who wanted to see your page. A fair click count leaves all four out.

App by app: who visits your link

Below is what visits a link when it is shared in the most common places. The "name it uses" column is the user agent: a short piece of text that every visitor sends to say what it is. Apps change version numbers often, but the names below have stayed the same for a long time.

We also see preview bots from Pinterest, Reddit, Viber, LINE, KakaoTalk, Bluesky, Zoom, Mattermost and services like Embedly and Iframely, which build previews for other websites.

Three rows in this table surprise almost everyone.

WhatsApp and iMessage previews come from a real phone

Most preview bots live in data centers, so a tool can spot them by where they come from. WhatsApp and Apple's Messages app work differently. To keep chats private, the preview is built on the sender's own device and sent along with the message.

That means the visit comes from an ordinary mobile or home internet connection, the same kind real people use, and often from the same city as your audience. If a tool only filters out "data center traffic", every WhatsApp share looks like a real click from a real person nearby.

There is one more detail. WhatsApp fetches the preview as soon as you paste the link into the message box, before you press send. You can watch it happen: the preview card appears above the keyboard while you are still typing. So even a link you paste and then delete, without sending, gets a visit.

For WhatsApp and iMessage, the name in the user agent is the only reliable clue.

iMessage introduces itself as Facebook and Twitter

Apple's preview fetcher calls itself facebookexternalhit/1.1 Facebot Twitterbot/1.0. That reads like a Facebook crawler and a Twitter crawler, but it is neither. It is Apple, working from the sender's iPhone, iPad or Mac.

Why borrow other names? Many websites only show their preview details (the title, description and image tags) to crawlers they recognise. Calling itself Facebook and Twitter gets Apple a good preview from almost any site.

This catches out a lot of tools. Anything that looks only for the word "facebookexternalhit" will file these visits under Facebook. You text a link to ten friends, and your dashboard reports a spike of Facebook visits. We match the full text exactly, so iMessage shows up as iMessage.

One Mastodon post can bring a crowd

Mastodon and other apps in the "fediverse" have no single central server. Each server that receives your post fetches the preview for its own users. A post from an account whose followers are spread across hundreds of servers can bring hundreds of visits in the first minute or two, all from different addresses.

If you post on Mastodon and see a burst of traffic that disappears right away, this is almost always why.

Email: the scanners that click every link

Email needs its own section, because here machines do more than read a preview. They open the link exactly as if someone had clicked it.

Many companies protect their inboxes with Microsoft Defender for Office 365 (its link protection is called Safe Links), Proofpoint, Mimecast, Barracuda and similar services. These systems can open the links in an incoming email to check where they lead, either when the email arrives or when someone clicks. Some of them pretend to be a normal browser on purpose, so that harmful pages can't hide from them.

In practice, this causes three problems:

• Inflated email clicks. Send a newsletter to business addresses and some "clicks" arrive within seconds of sending, sometimes on every link in the email at once. A person can't click six links in the same second. A scanner can.
• Clicks from people who never opened the email. The scanner acts before the person sees the message, so your report says they clicked even if they deleted it unread.
• One-time links that stop working. If a link does something the first time it is opened (confirms a subscription, signs someone in, unsubscribes them, uses up a coupon), a scanner can use it up before the person gets there. The safer pattern: the link opens a page, and the action needs a button press on that page.

Signs that a click came from an email scanner:

• Several links in the same email are "clicked" within a second or two.
• The click arrives within moments of sending, often before most people have even received the email.
• It comes from a cloud network such as Microsoft, Amazon or Google Cloud rather than a home or mobile connection.
• It says it is a normal browser but leaves out details every real browser sends, like the list of languages the person reads.

Crawlers, monitors and look-alikes

These visitors are slower and quieter than preview bots, but they add up over the life of a link.

Search engines. Googlebot, Bingbot, Applebot, DuckDuckBot and others find short links on public pages and follow them, often more than once. They arrive hours or days after you post.

AI crawlers. Posting a link on a public page now brings AI companies' crawlers too: GPTBot and ChatGPT-User from OpenAI, ClaudeBot from Anthropic, PerplexityBot, Bytespider from ByteDance and meta-externalagent from Meta, among others.

SEO tools. AhrefsBot, SemrushBot, MJ12bot (Majestic) and similar crawlers map links across the web.

Monitors and link checkers. Uptime services and broken-link checkers visit to see if a link still works. Many of them send a HEAD request, which asks only "does this exist?" without loading the page. A person's browser never does this when someone taps a link.

Browser prefetch. Some browsers load a page in advance when they predict you are about to tap it, to make it feel instant. These loads carry a label (Sec-Purpose: prefetch). If the person never taps, nobody actually visited.

Scripts dressed as browsers. Simple scripts often copy Chrome's user agent to avoid being blocked. They give themselves away by what they leave out: a real browser always says which languages its user reads and that it accepts web pages.

Why one check is never enough

Every method of spotting machines misses something. That is why a single filter, like "ignore data centers" or "ignore known bot names", always lets some through.

MiniSnip runs all four checks on every visit. The first two happen while the redirect is being sent, and they don't slow it down. The network and address checks happen right after the person has already been sent on, so they add no delay at all.

If any check says "machine", the visit is kept, but in a separate bots list with the reason, for example "Crawler user agent", "IP address in Facebook's server network" or "Server ...amazonaws.com". Your click count only includes people.

One honest limit: some people browse through a VPN that runs on a cloud server. Their visits can look like data center traffic and be listed as bots. We accept that trade. Missing a few VPN users is better than counting thousands of server visits as people.

Try it yourself in ten minutes

You don't have to take our word for any of this. Here is a simple test anyone can run.

1. Make a fresh short link to any page, so old visits don't mix in. A free MiniSnip account is enough. Don't open the link yourself.
2. WhatsApp: open the "Message yourself" chat, paste the link, wait for the preview card, and send it. Don't tap it.
3. Telegram: send the link to your Saved Messages. Don't tap it.
4. Slack or Discord: if you have a workspace or server of your own, post the link in a channel. Don't tap it.
5. Work email: if your company uses an email security service, email the link to your work address. Don't open the email.
6. Wait two minutes, then open the link's page in MiniSnip. The Bots chart and the Live feed list every visit with who it was and why it was recognised. Your human clicks should still be zero.
7. Now tap the link once on your phone. Your human clicks go to one.

If you also use another link shortener, run the same steps with a link from that tool and compare the numbers. The difference is the noise you have been counting as people.

What this means for your marketing

Don't judge a post in its first few minutes. Early numbers are mostly machines, especially in big groups, on Mastodon and in email.

Compare places by people, not raw hits. One busy group chat and one quiet channel can look similar if you count preview fetches. Counting only people shows you which place actually sends visitors.

Use a different short link for each place. The same link shared everywhere tells you how many people came, but not where from. One link per group, post or email makes every comparison simple.

Give your page a good preview. Every one of these bots reads your page's title, description and image. If they are missing, chats show a bare web address, and fewer people tap it. Check your page's preview before a big launch.

Make email actions need a button press. Never let opening a link alone confirm, cancel, unsubscribe or sign in. Scanners open links too.

Expect ad platforms to visit your landing page. Meta and Google check your page when you create or edit an ad. Those visits are not people. Our guide on checking whether your Instagram and Facebook clicks are real goes through Meta's visits in detail.

Watch unique visitors as well as clicks. One person tapping three times is three clicks but one visitor. Both numbers are useful, but they answer different questions.

How MiniSnip counts

Every visit to a MiniSnip link is recorded, so nothing is hidden, and every visit is classified with the checks described above. People are counted as clicks. Machines are kept in a separate list with their name and the reason they were recognised, so you can always see what visited and why.

For WhatsApp, Telegram, Instagram and other apps that hide where a click came from, MiniSnip also reads the clues those apps leave behind and shows the app by name. You can read more in our guide to tracking clicks from Instagram, WhatsApp and Telegram.