Half of users click on dodgy links. You just don’t know which half