What does a click-time URL-rewrite click record prove, and what does it not?

## What the record is A click-time URL protection service logs one row per resolution of a rewritten link. The fields you actually reason over are the timestamp, the mailbox identity the rewritten token was issued for, the original URL, the action the service took at that moment, whether the user proceeded past a warning page, the source address of the request, and an identifier tying the click back to the delivered message. Every one of those is a fact about the *redirect service*. That is the discipline this question is testing: state the claim in the direction the evidence actually points. ## The claim, stated honestly The service received a request for a token issued to that mailbox, at that time, and applied the verdict it held then. Everything past the redirect is inference. ## Three ways the obvious reading is wrong **Machines click.** Link previews in chat platforms, other mail-security or web-security products following the URL, mailbox rules and archiving tools, mobile clients prefetching content: all of these can request a rewritten URL. A cluster of clicks arriving within a second of delivery, from a hosting-provider address rather than a user's egress address, is almost always automation. Counting those as victims inflates an incident and sends you to interview people who did nothing. **The token names a mailbox, not a person.** The rewritten link is minted for the delivered message. If the recipient forwards it to a colleague, to a personal address, or into a chat channel, whoever clicks resolves the same token, and the record still says the original recipient. Shared and delegated mailboxes make this worse: the assistant who reads the executive's mail generates clicks attributed to the executive. **The record stops at the redirect.** The destination may have failed to load, been blocked by the web proxy a layer later, presented a login form the user closed, or harvested a password in full. The click log cannot distinguish those. Deciding which happened means pivoting to surfaces this control does not own, and you should say so rather than pretending the mail console answers it. ## Absence is not innocence No record is not evidence that nobody engaged. There is nothing to log if the user copied the address out of the rendered message and typed it into a browser, scanned a QR code with a personal phone, reached the same site from a search engine, or received the lure through a channel that never traversed the gateway. Reading an empty click log as proof of a clean campaign is the most confident way to close an incident that is still running. ## The verdict field, read correctly An allowed click means the service had no adverse verdict for that URL at that instant. It is not a safety certificate, and it is very often what you see for the first clicks on a link armed after delivery, precisely because reclassification came later. A blocked click means the destination was already known-bad when the request arrived, so the user was stopped at the gateway. The click-through flag is the highest-value bit in the record: a warning page was shown and a human chose to proceed, which is both a strong indication of real human engagement and a specific fact you will be asked about later. ## Turning clicks into a worklist When a campaign is confirmed after delivery, this record is what converts thousands of recipients into a handful of people who need attention. Rank them: clicked past a warning first, then clicks from user egress addresses at plausible human times, then clicks from privileged accounts, and drop the ones that look like automation after you have checked the source address and the timing. Each surviving name becomes an identity and endpoint question that is answered elsewhere. What you must not do is report the raw click count as a compromise count. ## The sentence that earns the mark "Twelve clicks were recorded, of which nine came from user egress addresses at working hours and two of those clicked through the warning page. That is nine people to check and two I would treat as engaged until proven otherwise. None of those records tells me a credential was submitted."