if they have gmail or office 365/outlook with an enterprise license, urls get sandbox detonated. You can tell if it was the sandbox or not by looking at the IP address and user agent fields in the http request of your canary hit. it should be the IP of your startup offices or in the cities your startup operates in, not some random cloud IP.