Expand my Community achievements bar.


Microsoft Bots overwritting URL parameter values


Level 4

Hi Awesome Brain Trust of Adobe Analytics (ABToA),


We are observing some visits where our campaign tracking code parameter values (in our case 'xcid') and even some Google UTM parameter values contain values that are not generated by our team (for that we use Claravine/TrackingFirst).


Has anyone else seen anything like this?


The look auto-generated...and until earlier this year were only a few hundred visits/month, but this year we are seeing a jump to over 5,000 per month.


They are being overwritten from tactics in all channels from google and bing advertising to emails we've sent out via Marketo.


We've tracked the IP addresses and they all seem to be coming from Microsoft IPs, so we assume it is some kind of bot.

Here are some examples of the variants...the numeric part will have tons of values so the seem to be auto generated:






Most seem to come from MS domains:


URL examples:



For now we will put hits from the IP addresses we've ID'd into our 'exclude bot' segment.


Any thoughts?





1 Accepted Solution


Correct answer by
Level 4

One thing that can be tried is  checking for UserAgent string for the traffic 

View solution in original post

6 Replies


Correct answer by
Level 4

One thing that can be tried is  checking for UserAgent string for the traffic 


Level 4

Hi, don't see anything out of the ordinary for useragent...pretty much reflects most of our traffic:




Community Advisor

Dear EggBoy,

Sorry, not sure on the above but sounds interesting.

Unable to see them as BOTS because I think that is something to do with authentication or some identifier auto appended by Marketo or Microsoft mail engine such as hotmail or live (A random thought).

Whats the device contribution? Is it only from Mobile Phone or around all the devices?

Should simulate the same to have better understanding.

Thank You, Pratheep Arun Raj B | Xerago | Terryn Winter Analytics 



Level 4

Hi @PratheepArunRaj seems to be all desktop. For Marketo, I did check those URLs and they were definitely overwritten from the original value (we tokenize that in the Marketo program). The URLs involved seem to be MOSTLY our homepage, in one of it's EN versions, or the main page of our blog...with a few other odd/random URLs in there too for some promo pages...strange and mysterious.




Employee Advisor

@EggBoy In order to check if these hits are bots 


You can try by analysing your traffic , check if each hit has one visits =page views = unique visitor, avg time spent is almost zero, and there a high page views in a visit

Also, you can check if this traffic is coming in a specific hour 


Here is the documentation on common bot signatures that can help you in identifying your traffic as bot




Hope this helps


Community Advisor

Seems like 2 diff marketing department yours and some other groups are adding tracking IDs.


I think in this case check are your desired IDs populating as expected? Check in network tab the beacon. If yes then its just a matter of filtering these URLs not desired I believe.