Bot filtering for email publishers

Let every reader through. Stop every scanner.

NVM answers each click on your email links in about a millisecond. People go straight to the page. Security scanners, crawlers and link previews stop at NVM, so every click you count is a person.

Get an API key Read the docs

Liveevery decision, 8 seconds behind

Allowed
Blocked
Checking

Last decision · 12:27 PM EDTAllowedGmail opened itMoncks Corner, SC · Google · Gmail image proxy

Allowed today

clicks and opens from readers

Blocked today

clicks and opens from machines

Share blocked

of today’s decisions

Decision time

–

median today, once clicks arrive

Latest decisions

The map’s flashes, in words

Time	Decision	Place	Network	Browser	Why
12:27:10 PM EDT	Allowed	Moncks Corner, SC	Google	Gmail image proxy	Gmail opened it

Today’s places as a table

Place	Allowed	Blocked
Moncks Corner, SC	5	0

34msa reader’s click, from the link to the page

1,473clicks a second in a burst, every one recorded

14,000reported opens and clicks judged a second

5North American regions answer each click

Measured on October 14, 2026Against production, from Philadelphia

How it works

We judge every click before the page loads.

Seal

Your server seals each link of an email with your key: where it goes, the campaign, the reader and when you sent it. A scanner that takes a link apart learns nothing.

0database calls between a click and its page

Judge

In the region nearest the reader, NVM reads the network, the browser, its headers and TLS handshake, and the time since you sent. A reader goes straight to the page. A bot or a script gets a blank page; a scanner gets a page that waits for one tap.

0.5msmedian decision in the burst test

Settle

Within a minute, NVM settles every click. A scanner that opened every link of the email at once, or the hidden trap link, turns to a machine. Read each verdict from the API.

1minto settle a click, or eleven when a check page went out

Quality

Count people, never scanners.

A scanner clicks like no person does: from a cloud, seconds after delivery, every link at once, in a browser that does not exist. NVM catches it on the request, and on what the rest of the email does.

What a send sets off

Good Daily’s clicks on October 14, 8:00 AM to 1:43 PM ET, minute by minute, through NVM’s judge.

10,000 a minute5,0009,754 clicks in the minute fromat 9:46 AM

96,978clicks the email platforms recorded

94%were machines, NVM’s judge found

445clicks in the busiest second, at 9:49 AM

3clicks in the median minute

NVM’s burst test recorded 1,473 clicks a second, more than three times this morning’s busiest second.

What gave the machines away

The same morning’s clicks. One click can show several signs.

From a cloud or a security vendor79%76,813 clicks · Amazon, Microsoft and M247, the most
Every link of the email at once67%64,753 clicks · Three or more other links of the email within two seconds, from one network
Within ten seconds of the send32%30,575 clicks · Scanners fetch every link as the email arrives
A request no browser sends47%3,839 of the 8,218 clicks whose request was logged in full: a cut-off Safari token, a byte range, the tracker as its referrer, a full Chrome version

One email, every link at once

17 seconds after the send, from Amazon.

+0 sLink 1 of the emailAmazon
+1 sLink 2 of the emailAmazon
+1 sLink 3 of the emailAmazon
+2 sLink 4 of the emailAmazon
+2 sLink 5 of the emailAmazon

The reader’s click, when it comesOne link, minutes or hours later: straight to the page

3,093of the 6,309 emails clicked that morning met a scanner like this one: four links or more in two seconds

When the request cannot tell

A reader sees this for a moment, then the page.

5KBthe whole check page, its style and script inline: it paints in the first round trip

API

Seal, judge and read with one small API.

Seal your links, judge the opens and clicks you already track, and read every verdict by campaign, link and reader.

Seal anywhere. The one-file SDK seals links on your servers, with no request to NVM per link; or send a whole email to POST /v1/wrap.
Judge what you track. POST /v1/classify answers human or machine for up to 1,000 opens and clicks a request.
Every verdict explained. Each click keeps the signs that decided it, so you can see why.

The endpoints you start with

POST/v1/wrapSeal every link of an email
POST/v1/linksSeal links, pixels and traps
POST/v1/classifyJudge up to 1,000 opens and clicks
GET/v1/clicksRead each click and why NVM judged it so
GET/v1/campaigns/{id}Count a campaign’s clicks and opens
GET/v1/recipientsSync each reader’s engagement

On your server, as you send

// The SDK, one file with no dependencies:
// https://nvm-6amcity.vercel.app/sdk/nvm.ts
import { Nvm } from './nvm';

const nvm = new Nvm({
  // nvm_sk_<id>_<secret>, from the admin.
  secret: process.env.NVM_SIGNING_SECRET,
  // NVM's address, or your own link domain.
  origin: 'https://nvm-6amcity.vercel.app',
});

const html = nvm.wrap(issueHtml, {
  // Your id for the issue, up to 64 bytes.
  campaign: 'greenville-2026-10-14',
  // Your id for the reader, never the address.
  recipient: subscriber.id,
  // Only its domain is used: who hosts the mailbox.
  email: subscriber.email,
  // When you hand this email to your platform.
  sentAt: new Date(),
});

Products

Three ways to use it.

Route your links through NVM, count opens with its pixel, or send it the activity your own tracker saw.

Sealed links

Readers reach the page at once. Scanners stop at NVM, before your site and your counts.

See the links

The open pixel

Tell a reader’s open from Apple Mail’s privacy fetch and a scanner’s, from the same pixel.

See the pixel

The activity API

Send the opens and clicks your platform recorded. NVM answers human or machine for each.

See the activity API

Promises

Rules that put readers first.

No puzzlesA reader never solves one. When NVM cannot tell, a check page reads the browser in a moment, and at most asks for one tap.

Nothing waits on a databaseEach link carries what NVM needs, so a burst of clicks never queues behind a lookup.

Every click countedIn the burst test, 6,000 clicks at 1,473 a second: NVM recorded all 6,000.

Every verdict explainedEach click keeps the signs that decided it, in the API and in the admin.

Sealed linksOnly NVM can read a link’s page, campaign and reader. A scanner that takes it apart sees nothing.

Addresses kept 30 daysNVM keeps a reader’s IP address for 30 days, then only its network.

Get started

Seal your first link today.

Make a key in the admin, seal an email’s links, and send it. Its clicks light up the map eight seconds later.

Get an API key Read the quickstart