Does anyone know what are 'unknown device types' under the device breakdown? Why are the devices unknown.
A user agent is software (a software agent) that is acting on behalf of a user, such as a web browser that "retrieves, renders and facilitates end user interaction with Web content". When a software agent operates in a network protocol, it often identifies itself, its application type, operating system, software vendor, or software revision, by submitting a characteristic identification string to its operating peer. This identification is transmitted in a header field User-Agent.
Here's an example of a user agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
What is likely happening is that the user is opening the phishing email in a web browser, the browser is either providing a user agent where the hardware type isn't specified or unknown.
You can read up more on User Agents on the Wiki page.
That's great. Thanks MEric