Methods, systems, and devices for filtering network traffic from automated scanner are described. A device (e.g., an application server) may receive an activity message associated with an interaction with an electronic communication message and identify, from the activity message, at least a source identifier of the activity message and one or more attributes associated with the electronic communication message. The device may then add the activity message to a mapping of source identifiers and attributes associated with previously received activity messages and classify the activity message as being associated with an automated scanner based on a comparison of the received activity message to the mapping over a previous time window. Upon classifying the activity message, the device may transmit a classification result to an external server.