Bot or Not? – Are you suffering from ‘bot clicks’? | Community
Skip to main content
Ronen-Was-SRpro
Level 5
September 4, 2018
Question

Bot or Not? – Are you suffering from ‘bot clicks’?

  • September 4, 2018
  • 12 replies
  • 26686 views

If you are a marketer, you probably have heard about the somewhat new and emerging enemy: The Email Security Bots. The war is on and we have been standing clueless for a while, watching from the side while the Bots were messing with our numbers, with no real solution available.
Well, it’s time to fight back!
It all started a couple of years ago when some of our customers noticed a surge in email click metrics and they also pointed out some interesting and strange behaviors in their data:

  • Seconds after email is delivered, they see a high volume of clicks
  • They noticed a high volume of clicks from the same account/company
  • The activity log shows ‘clicked a link in an email’ before the ‘email open’ event and in many cases without visiting the actual page

Our research concluded those behaviors are typical for Bots, and NOT for humans. The bots' role is to click each link in emails, sent to the domain they protect, to prevent harmful clicks that can harm the company by flagging them as a phishing scam.
The implications of those Bots clicks can be devastating for marketing teams worldwide.
All your marketing numbers could be way off. It means you’ve been counting clicks completely wrong in your marketing automation program. Not to mention the impact on your scoring, interesting moments and nurturing campaigns and obviously your reports.
We, at eDigital.Marketing, did an extensive research and came up with a solution that we would like to share with you. We implemented it in our customers' instances and our customers are surprised by the findings and are satisfied with the results.
We started by running a test on an email that was part of a nurturing campaign already built in Marketo.
The test was using a Smart Campaign that was listening to page visits and email delivery.
The program was running for about five days to allow enough time for prospects to actually click on the link in the email.
Five days later we ran a new Smart Campaign just to collect data from Marketo about "clicked the link in the email" without any filters at all.
We downloaded both lists to excel and checked for clicks in Marketo that were NOT in the list we have created. Here are the shocking numbers:
Marketo counted 327 clicks WHILE the Smart Campaign only identified 91 of those clicks as real people who clicked the link and actually visited the page.

So at that point, it was pretty simple to calculate that approximately 72% of those clicks were fake and were made by ‘Bots’, we then identified and created a list of the companies that are using bots as part of their IT security infrastructure.
To make things even more complicated, we then went ahead and made some additional research on the list and found that a third of the remaining ‘humans’ can NOT be counted as clicked anyway since they visited the webpage in the past and NOT by using the email we've tested. The Smart Campaign was flagging them since the email was delivered to them and indeed in the past, they visited the page.
BUT since we compared the Marketo clicks to the Smart Campaign clicks, those ‘humans’ (that didn't click but visited the page) where excluded and therefore no extra calculating was needed.
To make sure the data is correct, we sampled some ‘Bot’ leads and checked their logs in Marketo. All leads from all companies who were suspected to be using ‘bots’ were showing the activity of a ‘bot’ - clicked but no open nor visited page.
In conclusion, out of 327 clicks identified by Marketo, only 91 were Humans.
Now all was left for us to do is to add a few Smart Campaigns to neutralize the Bots and stop them from disrupting the scoring system, the interesting moments and all reporting.
We now have a Bot system running in the background making sure all our numbers are correct and not just making us look good.

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

12 replies

Chris_Wilcox
Level 8
September 4, 2018

We've definitely seen the same issue. It's fairly isolated in our industry and we see bot-clicks in a pretty specific region, but our numbers are even farther off than the 72% you're seeing. We're talking 93-96% inaccurate.

We've since started utilizing the page view as the trigger for those groups as well which has helped, but the biggest issue for me is associating those clicks (web views) back to the program level in an automated way. Since the clicked link in email activity has a program ID associated, but the web page visit activity log will not.

It's a serious issue that Marketo itself needs to bake into the platform. We've been trying to get cleaner data with our own workarounds, but it really only works in a program-to-program basis and haven't been able to come up with an instance wide solution that we could set up to have running all the time.

Dan_Stevens_
Level 10
September 4, 2018

To ensure you’re truly dealing with human activity, you need to measure one additional step - and that’s identifying those that are web page visits are also clicking on a link (or submitting a form) on the landing page. Today, bots can trigger web page visits as well.

Josh_Hill13
Level 10
September 4, 2018

Agree.

I'd love to see a clearer set of images or diagrams for how you did this Ronen.

Amy_Goldfine
Level 9
September 4, 2018

Yes! I appreciate learning about what you discovered but I feel like you yada yada yada'd past the good part!

Amy GoldfineMarketo Champion & Adobe Community Advisor
Level 3
September 4, 2018

Here's another place where this can bite you: reports. We email a daily "known visitors" and a weekly "anonymous visitors" report for specific geos/segments to the relevant sales teams. After a nurture or promotional email drops, the sales team sees a "too good to be true" surge of visitors from some accounts. So many things are wrong at this point. First, the sales team wastes time getting excited about a sudden spike in interest from an account that turns out to be a waste of time. This in turn damages the credibility of these reports (and thus of Marketo and Marketing Ops in general). And worse, as you can imagine, the sales teams who really embrace these reports are of course the most effective and good partners for marketers; so it's doubly a shame when these reports send false positives. Would also love to see some schematics or smart list/flow screenshots that give us a head start. These metrics are still useful, so we haven't discontintinued the reports; but you really just can't tell your sales team "don't believe them under XX conditions until we have time to re-rationalize them."

Danielle_Wong
Community Advisor
Community Advisor
September 4, 2018
The test was using a Smart Campaign that was listening to page visits and email delivery.

how exactly did you set this test up?

Danielle W.
Dezie_Okpoebo
Level 2
September 5, 2018

I have also experienced this, and while I can't speak to the percentage of clicks that were "false" as I haven't run that full research, it has caused us many issues; Sales reps following up on false leads, bad & misleading reporting, etc. The solution highlighted above is a good one, but as some have noted, bots can also "view webpages." We were also having a hard time when we simply sent people to a pdf from an email. You can't see webpage visits to a pdf, unfortunately.


So we implemented a honeypot to our emails. A honeypot is also seen as bait for a bot that humans cannot see or click. We added a 1x1 pixel image that blended into either the header or the footer of our emails and hyperlinked it to a specific page. Now a human cannot see that link and therefore will not click the link, but bots will click every link within an email (as far as I know). We then created a smart list of clicks to that honeypot link, and used that to suppress the bots from reporting, Salesforce, interesting moments, lead scoring, you name it. I've heard back from Sales reps that the leads they are seeing have all improved significantly since we implemented the honeypot.

Chris_Wilcox
Level 8
September 5, 2018

This is also a great method, but can you elaborate on specifically how your reporting is suppressing the link? We have a lot of ongoing pushes to our CRM when activities take place, how are you able to filter out only the bot clicks? Or, are you simply filtering any clicks from that email address if you see the honeypot interaction? Our goal is to suppress the bot click, but still try to capture any human engagement even if a bot had initially reviewed/clicked the email.

Dezie_Okpoebo
Level 2
September 6, 2018

Hi Chris - Being able to differentiate the bot click from the human interaction is an issue we haven't been able to solve just yet, unfortunately. Though I've considered trying to combine the honeypot method with the "visited webpage" method to decipher between bots and human engagement. But again, that initial engagement with the honeypot remains on the contact activity. Anyone else have ideas on this?

Rafael_Santoni1
Level 5
September 6, 2018

What did you do when you say at the end...

"Now all was left for us to do is to add a few Smart Campaigns to neutralize the Bots and stop them from disrupting the scoring system, the interesting moments and all reporting.

We now have a Bot system running in the background making sure all our numbers are correct and not just making us look good."

Did you manage to make the Marketo native reports be accurate by excluding the bots, or are you now reporting using a different system/method?

Level 2
September 13, 2018

Yes we were recently affected by bot activity that hijacked our Marketo form. Fortunately, the bot was using the same IP each time so I set a flow step to block the activity based on IP.

SanfordWhiteman
Level 10
September 14, 2018

@Raj Jain​ the "bot" being discussed here is an automated scanner that pre-follows links for security purposes, not a malicious bot.

Justin_King
Level 2
January 7, 2019

I'm sure this has been asked and answered, but I can't find it explicitly, so here goes:

Why can we not add a wait step?  So the functionality would look like this:

Smart List: Email is Delivered

Flow:

- Wait 10 Seconds

- Request Campaign (Your normal email processing campaign)

This way you're not monitoring activity on the email until 10 seconds after delivery, which should exclude the majority of bot activity (but I understand not 100% of it). 

Either way, if you deliver an email, track link clicks 10 seconds later. then lead them to a page with either an active form or a hyperlinked path, your stats should be relatively clean. 

That's my (very top-level) hypothesis at least.  Rather than taking the amount of time it would to test though, I figured I'd come to the experts and see if it's even worth my time. 

Another side question I had was the function of the "Clicks Link." Is this an active tracker?  OR will it pick up the bot click in retrospect?  (rendering the 10 second wait step nearly useless, as everything above can be accomplished without it)

Thanks in advance!!!

Justin

Denise_Greenb12
Level 6
January 8, 2019

Hi Justin,

While I'm not an expert on bots, I very much doubt that you can count on "wait 10 seconds" to eliminate them for a couple of reasons: 1) I doubt you can count on the precise timing of bot clicks vis-a-vis when Marketo deems the email has been delivered; the bot may "click" the links more than 10 seconds later. And 2) the wait step means your campaign will run at low priority, so the flow steps after the wait stepcould be run a lot longer 10 seconds after the email was delivered, depending upon what higher priority campaigns are active at the time.

"Clicks Link" as a trigger (in orange) reacts as soon as it sees the link clicked.

"Clicked Link" is a filter that looks for past activity. You can control how far in the past with constraints (e.g., Clicked Link in past 5 minutes, 30 days, etc.).

Denise

SanfordWhiteman
Level 10
January 8, 2019

Exactly, there's nowhere near 10s granularity available here.

Preston_Zeller
Level 1
April 5, 2019

We have seen a similar situation to this thread creeping in on our metrics.

Recently, I decided to break down our email traffic by Browser and Browser version, in accordance with some helpful tips from this article.

Specifically, this part:

The most common fingerprint of a bot visit (within Google Analytics) is very low quality traffic – indicated by 100% New Sessions, 100% Bounce Rate, 1.00 Pages/Session, 00.00.00 Avg Session Duration, or all of the above.

The Criteria:

Looking at traffic using the criteria above (slight deviation in sessions vs new sessions OK), also checking out if they hit a goal completion or not. Traffic is from Q1'19

The Findings:

Of the 70K users/sessions, about 2K of them appear to have actual activity attached to them.

This would indicate about 2.85% of my email clicks were from email traffic. Put another way 97% of our email traffic was likely from these email scanners.

Image Snippet from GA report:

Conclusion:

We're still tackling exactly how to approach reporting of true email traffic, but one thing is for sure: all is not what it seems!

Josh_Hill13
Level 10
May 3, 2019

That's quite helpful. We have estimated that 70-90% of our clicks are spam, which is hugely disappointing of course.

@Sanford Whiteman​ - is it possible to take the Click Detail from the logs and put it into a table like the above? I've been somewhat suspicious that the Device and Browser Type would be a clue to a click scanner. I bet this is an API pull though.

Michael_Whitake
Level 2
May 2, 2019

Has anyone seen the numbers for Opens getting skewed as well? Since that number is tracked via an image/pixel, I'm surprised to not hear about skewing of that number.

SanfordWhiteman
Level 10
May 2, 2019

Good question. But remember that the mail scanners are interested in security (not privacy) risks. A 1x1 image wouldn't be a security concern (unlike for example a giant 800x600 image with spamvertising text on it, which would be worth OCRing). So to the degree that a scanner can predict final visual layout the pixel wouldn't be worth fetching.

Josh_Hill13
Level 10
May 3, 2019

Yep, we haven't seen that behavior.