Visitors Log & Source Attribution

The All visitors page (CRM → Visitors) is the complete, row-by-row history of everyone who opened your ScaanMe profile or store. Each row tells you when they arrived, where they were (city and country), what device they used, and — most importantly — which channel sent them. It is the raw truth behind every chart on your Overview: nothing here is guessed or invented, every visit is a real event your profile recorded.

Capture is automatic and always-on for every plan — you never have to add a tracking script or flip a switch. The moment someone opens your profile, ScaanMe records the visit in the background. The Visitors dashboard (this page) is the part gated by your plan, but the data underneath is collected for everyone, so upgrading later means your history is already there waiting.

Who is this for? Anyone who wants to stop guessing where their leads come from. If you print QR codes on flyers, tap NFC cards at events, post your link on Instagram, and run a Google ad — this log shows you which of those actually drove traffic, down to the individual visit. That lets you double down on what works and cut what doesn't.

The table has seven columns: When · Location · Device · Platform · Source · Lang · IP (approx.). Rows are newest-first and the list paginates 50 at a time (the line above the table reads e.g. *Showing 1–50 of 1,284*). The subtitle under the page title is your honesty contract: *Full visit history · bots excluded · source recovered from device signals · geo approx. by IP*.

When shows a friendly relative time like *3 minutes ago* or *2 days ago* (computed from the exact timestamp). Location shows a country flag followed by *City, Country* — for example 🇰🇼 *Kuwait City, Kuwait*. If the IP couldn't be placed, you'll see a dash (—). The geo is approximate by design (see the geo block below), so treat city as a strong hint, not a GPS pin.

Device is a cleaned-up class — iPhone, Android, iPad, Mac, Windows, Linux, or Other — not the raw, often-junk user-agent string. Platform shows the underlying OS detail (e.g. *iOS 17*, *Windows 10*). ScaanMe normalizes these for you because raw device fields are notoriously messy (you'll sometimes see values like *WebKit* or *Macintosh* in raw data); the clean label is what you read.

Source is the headline of every row — a colored pill with a small channel icon, like *Instagram*, *QR code*, or *Apple Wallet*. Direct/unattributed visits show a muted gray pill. Bot rows show an amber Bot pill instead (with a tooltip: *Automated bot / link-preview crawler — not a human visit*). Lang is the browser language (e.g. *en*, *ar*), and IP (approx.) is the visitor's IP address — useful for spotting repeat visitors or office networks, shown as approximate because mobile carriers and VPNs shift IPs.

Any human row with a known visitor ID is clickable — a small ▸ arrow appears on the left. Click it and the row expands in place to reveal that visitor's full journey: every section they viewed, every button they tapped, how long they stayed, and any form they submitted. This is the bridge from an anonymous visit to a named person once they identify themselves. Bot rows and rows without a tracked ID don't expand.

The filter bar sits above the table and updates the list live as you change it — no page reload, no losing your place. Everything you set is reflected in five summary cards just under the bar: Visits · Unique visitors · Identified · Top source · Top country, all recalculated for the filtered set so the numbers always match what you're looking at.

Search box — type anything and it matches across city, country, region, IP, device, platform, language, and the recovered source label all at once. So typing *instagram* shows only Instagram visits, *iphone* shows only iPhones, and *kuwait* shows only Kuwaiti visits. It debounces while you type (waits ~0.3s) so it feels instant without hammering the server, and the box never loses focus mid-type.

All sources dropdown — narrows to one exact channel (QR code, Instagram, Google Ads, Apple Wallet…). The options are built from the channels that *actually appear in your own data*, sorted by frequency, so you never see a source you've never received. All devices dropdown — choose Mobile (iPhone, Android, iPad and the like) or Desktop (Windows, Mac, Linux) to split phone traffic from computer traffic.

Everyone dropdown (the *who* filter) — switch between Identified (visitors you now know by name, because they later filled a form, booked, or subscribed and got stitched back to their earlier anonymous visits) and Anonymous (still unknown devices). This is powerful: filter to *Identified* and you're looking at the visits of people who became real contacts, so you can see exactly which channel produced your actual leads.

Date range — pick a preset (All time, 24 hours, 7 days, 30 days, 90 days) or choose Custom range and set the From and To boxes (shown as DD-MM-YYYY). The named range and the custom dates stay in sync: picking a preset clears the custom dates, and typing a custom date flips the dropdown to *Custom range* automatically, so they never fight each other.

When any filter is active, a Clear filters link appears to reset everything in one click. Your filters also travel with the Export button — see the export block. Tip: combine filters freely, e.g. *Identified + Instagram + last 30 days* answers "how many real leads did Instagram give me this month?" in one screen.

On the right above the table is a three-way toggle: All · Humans · Bots, each with a live count, e.g. *Humans (1,180) · Bots (104)*. By default the system is honest: bots are already excluded from every chart and KPI on your Overview, so your visit numbers reflect real people. This toggle lets you choose what the visitor *table* shows.

What counts as a bot? Link-preview crawlers and scrapers — the automated fetchers that grab your page to build a preview thumbnail when your link is pasted somewhere. ScaanMe recognizes them by signature: Googlebot, bingbot, facebookexternalhit, the WhatsApp preview fetcher, Twitterbot, LinkedInBot, TelegramBot, Discordbot, Applebot, AhrefsBot, SemrushBot, Bytespider, plus headless browsers and scripted clients (HeadlessChrome, python-requests, curl, node-fetch, axios) and anything labelled crawler or spider.

Why surface bots at all? Because a bot hit usually means your link was just shared somewhere — when WhatsApp's crawler fetches your card, it's because someone pasted your link into a chat. ScaanMe reports this honestly as link reach, never as a human visit, so the two never get mixed up. Flip to Bots when you want to confirm your link is being shared and previewed across platforms.

The bot counts on the toggle reflect all your other active filters (search, source, device, date) — but not the toggle itself. So if you've filtered to *last 7 days*, the Humans/Bots numbers are the human/bot split *within those 7 days*. The default view is All, which shows both with bots visually dimmed and marked with the amber pill, so you can always tell them apart at a glance.

This is the engine that makes the Source column trustworthy. Most analytics tools can only say *Direct* or *Referral* because social and messaging apps strip the referrer. ScaanMe recovers the real channel by checking signals in a strict priority order — most reliable first — and only falls back to *Direct* when there's genuinely no signal. It never guesses: absence of a signal becomes *Direct / Unattributed*, not a fabricated source.

Priority 1 — our own self-stamp (most reliable). When you generate a QR code, an NFC tap, a share or wallet link inside ScaanMe, we quietly add a ?s= tag to it. That tag survives even when everything else is stripped. The stamps map to friendly labels: QR code (qr), NFC tap (nfc), Share button (share), Print (print), Link in bio (bio), Email (email), SMS (sms), WhatsApp (wa), Table QR (table), Wallet (wallet), and the two distinct wallets below.

Apple Wallet and Google Wallet are tracked separately. A visit stamped awallet shows as Apple Wallet and one stamped gwallet shows as Google Wallet — never merged. This matters because the two platforms behave very differently and you'll often want to know which wallet your audience actually uses. (Note: wallet *saves* themselves are anonymous by design — the platforms don't reveal who saved — but a tap-through from a saved pass carries the stamp.)

Priority 2 — paid ad click IDs. If the link carries an advertiser click ID, ScaanMe maps it to the right ad network: fbclid → Meta Ads, gclid / gbraid / wbraid → Google Ads, ttclid → TikTok Ads, msclkid → Microsoft Ads. These are appended automatically by the ad platforms when someone clicks your ad, so paid traffic is attributed even without UTMs.

Priority 3 — UTM tags. If you've tagged a link with utm_source (the standard marketing convention), ScaanMe uses it and shows it capitalized — utm_source=newsletter becomes Newsletter. Use UTMs on any custom campaign link where the channel isn't one we stamp for you.

Priority 4 — in-app browser fingerprint (the magic step). Social and messaging apps open links in their own built-in browser, which deletes the referrer — but leaves a tell-tale signature in the technical request. ScaanMe reads it to recover Instagram, Facebook, Messenger, TikTok, Snapchat, X (Twitter), LinkedIn, Telegram, Pinterest, Reddit, KakaoTalk, Viber, LINE, DuckDuckGo, and the Google app. This single trick is how the bulk of your social traffic becomes attributable instead of vanishing into *Direct*.

Priority 5 — referrer host (when one survives). If a normal browser passes a referrer, ScaanMe classifies it: search engines become Google search, Bing, Yahoo, DuckDuckGo, Yandex; social hosts become Instagram, Facebook, TikTok, X (Twitter), LinkedIn, YouTube, WhatsApp; and any other external site becomes a generic Referral. Your own ScaanMe domains are excluded so internal navigation never counts as a referral. Priority 6 — Direct: when no signal at all exists, the visit is *Direct*.

The single most common question: *"I tap my NFC card and it shows Direct — why?"* The answer is the priority list above. A QR or NFC link only attributes correctly if it carries our ?s=qr / ?s=nfc stamp. When you generate codes and share links from inside ScaanMe, that stamp is added for you automatically and they appear as QR code / NFC tap. The problem starts when the link gets stripped.

How does a stamp get lost? If you copy just the bare profile URL (without the ?s= part) and paste it onto a flyer, into a third-party QR generator, or onto a blank NFC chip, the stamp isn't there — so when someone scans it there's no signal at all and it correctly lands as Direct. ScaanMe won't fake it. The fix is simple: always generate your QR codes and grab your NFC/share links from inside ScaanMe so the stamp rides along.

Direct is also genuinely correct in many cases: someone typing your URL by hand, opening a bookmark, clicking a link in a note-taking app, or arriving from a desktop app that passes no referrer all legitimately have no recoverable source. A healthy account always has *some* Direct — it's not an error, it's honesty. The goal isn't zero Direct; it's making sure your *known* channels (QR, NFC, socials, ads) are correctly attributed so Direct only holds the truly untraceable visits.

ScaanMe resolves location from the visitor's IP using an offline city database that lives on our own server — the IP never leaves the server and is never sent to a third party, so it's fast and private. From the IP it derives country, country code (for the flag), region/state, and city, plus internal coordinates used to plot your visitor map. Resolution happens in the background after the visit, so a brand-new row may briefly show a dash before the city fills in.

City is an approximation, by design — that's why the column header literally says *IP (approx.)* and the page subtitle says *geo approx. by IP*. IP geolocation places someone in the right city or metro area most of the time, but mobile networks, corporate VPNs, and carrier routing can place a real Kuwait City visitor in a neighbouring city or even the carrier's hub. Read city as a strong regional signal, not a precise address — and country is far more reliable than city.

Private or unknown IPs (a local network, the server itself, or an address the database can't place) simply return no location — you'll see a 🌐 globe or a dash rather than a wrong guess. The IP column itself is handy beyond geo: a repeated IP across several rows often means the same person came back, or several people share one office/Wi-Fi network. You can also paste an IP into the search box to pull up every visit from it.

The Export button (top-right of the filter bar) downloads the currently-filtered list as a CSV you can open in Excel or Google Sheets. Crucially, it respects every filter you've set — search, source, device, who, date, and scope — so you export exactly what's on screen, not the whole table. The export link updates live as you change filters.

The CSV has eleven columns: When, City, Region, Country, CC, Device, Platform, Lang, IP, Source, Referrer. Note it includes two fields the on-screen table doesn't: the full Region (state/province) and the raw Referrer URL — useful for deep analysis or feeding another tool. The Source column carries the same recovered channel label you see in the app.

The export is capped at 10,000 rows to keep the download fast and your browser responsive — if your filtered set is larger, narrow the date range and export in slices. Every cell is also protected against spreadsheet formula-injection (a safety measure so a value beginning with = can't run as a formula when opened in Excel), so your exports are safe to open directly.

Always create links from inside ScaanMe. Generate QR codes, copy share links, and provision NFC from within the app so the ?s= stamp is attached — that's the difference between seeing *QR code* / *NFC tap* and seeing *Direct*. A bare copied URL loses its source; a ScaanMe-generated one keeps it.

Tag your own campaigns with UTMs. For channels we don't stamp — a guest-post link, a partner's newsletter, a printed magazine ad — add ?utm_source=... so the visit attributes to a clear name instead of falling into Referral or Direct. This keeps your Source breakdown clean and comparable.

Use the Identified filter to measure real ROI. Filtering to *Identified* shows visits from people who became actual contacts. Cross that with a source to answer the only question that matters: which channel produced leads, not just clicks. A channel with lots of visits but zero identified contacts is loud but not profitable.

Don't panic about bots — read them as reach. A spike in the Bots tab usually means your link is being shared and previewed across chats and feeds. It's a healthy signal of distribution. Just remember none of it inflates your real visit numbers, which always exclude bots automatically.

Click into a visitor's journey before judging a source. A single QR-code visit that viewed three sections, tapped WhatsApp, and stayed 90 seconds is worth more than ten Direct visits that bounced instantly. Expand the row to see depth of engagement, not just the channel name — that context is what turns a number into a decision.

Why does my own NFC card show as 'Direct'? Almost always because the NFC chip was written with the bare profile URL instead of the ScaanMe-stamped one. Re-provision the NFC link from inside ScaanMe so it carries ?s=nfc, and new taps will correctly read NFC tap. Existing visits already logged as Direct won't change retroactively.

What's the difference between Apple Wallet and Google Wallet in the log? They're two completely separate sources. awallet shows as Apple Wallet, gwallet as Google Wallet, and they're never merged into a generic "Wallet" — so you can see which platform your audience prefers. The act of *saving* a pass is anonymous (the platforms don't tell us who saved), but a click from a saved pass is attributed.

How does ScaanMe know it was Instagram if Instagram hides the referrer? Instagram (and TikTok, Facebook, Snapchat, and others) open links in their own in-app browser, which strips the referrer but leaves a recognizable fingerprint in the technical request. ScaanMe reads that fingerprint to recover the channel — which is why social traffic shows up as Instagram rather than disappearing into Direct.

Are bots counted in my visit numbers? No. Bots are excluded from every KPI, chart, and the human visit count automatically. They're only ever visible if you deliberately switch the table to the Bots tab, where they're presented honestly as link-preview/share reach — never as real visitors.

How accurate is the city? Country is highly reliable; city is a good approximation that's right most of the time but can be off by a city or region because of mobile carriers and VPNs — hence the *(approx.)* label. We look it up from the IP using an offline database on our own server, so your visitors' IPs are never shared with any outside service.

A row in my Visitors log won't expand — why? Only human rows that have a tracked visitor ID are expandable into a journey. Bot rows never expand (there's no human journey behind them), and the occasional human row that arrived before a visitor ID could be set also won't open. Look for the small ▸ arrow on the left — if it's there, the row expands.

Do I need to install any tracking code to get this data? No. Visit capture is built into your profile and turned on for everyone automatically — there's nothing to install, embed, or configure. The Visitors dashboard you read here is the plan-gated part, but the underlying data is collected for all accounts, so it's already there when you need it.