Microsoft Bots overwritting URL parameter values | Community
Skip to main content
EggBoy
EggBoy
Level 3
September 15, 2021
Solved

Microsoft Bots overwritting URL parameter values

  • September 15, 2021
  • 4 replies
  • 2433 views

Hi Awesome Brain Trust of Adobe Analytics (ABToA),

 

We are observing some visits where our campaign tracking code parameter values (in our case 'xcid') and even some Google UTM parameter values contain values that are not generated by our team (for that we use Claravine/TrackingFirst).

 

Has anyone else seen anything like this?

 

The look auto-generated...and until earlier this year were only a few hundred visits/month, but this year we are seeing a jump to over 5,000 per month.

 

They are being overwritten from tactics in all channels from google and bing advertising to emails we've sent out via Marketo.

 

We've tracked the IP addresses and they all seem to be coming from Microsoft IPs, so we assume it is some kind of bot.

Here are some examples of the variants...the numeric part will have tons of values so the seem to be auto generated:

b-b_48882
ccd-ccd_31350

dbagc-ace_48167
fkg0039

fz-6eec_54792
fz-be_31072

fz-ge_bdbeg

 

Most seem to come from MS domains:

URL examples:

 

For now we will put hits from the IP addresses we've ID'd into our 'exclude bot' segment.

 

Any thoughts?

 

Thanks!

 

 

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
    Best answer by suneeshkachroo

    One thing that can be tried is  checking for UserAgent string for the traffic 

    4 replies

    suneeshkachroo
    suneeshkachrooAccepted solution
    Level 4
    September 15, 2021

    One thing that can be tried is  checking for UserAgent string for the traffic 

      EggBoy
      EggBoyAuthor
      Level 3
      September 17, 2021

      Hi, don't see anything out of the ordinary for useragent...pretty much reflects most of our traffic:

       

      PratheepArunRaj
      Community Advisor and Adobe Champion
      PratheepArunRajCommunity Advisor and Adobe Champion
      Community Advisor and Adobe Champion
      September 15, 2021

      Dear EggBoy,

      Sorry, not sure on the above but sounds interesting.

      Unable to see them as BOTS because I think that is something to do with authentication or some identifier auto appended by Marketo or Microsoft mail engine such as hotmail or live (A random thought).

      Whats the device contribution? Is it only from Mobile Phone or around all the devices?

      Should simulate the same to have better understanding.

      Thank You, Pratheep Arun Raj B | Xerago | Terryn Winter Analytics 

       

      Thank You, Pratheep Arun Raj B (Arun) | Xerago | Terryn Winter Analytics
        EggBoy
        EggBoyAuthor
        Level 3
        September 17, 2021

        Hi @pratheeparunraj seems to be all desktop. For Marketo, I did check those URLs and they were definitely overwritten from the original value (we tokenize that in the Marketo program). The URLs involved seem to be MOSTLY our homepage, in one of it's EN versions, or the main page of our blog...with a few other odd/random URLs in there too for some promo pages...strange and mysterious.

         

        VaniBhemarasetty
        Adobe Employee
        VaniBhemarasettyAdobe Employee
        Adobe Employee
        September 16, 2021

        @eggboy In order to check if these hits are bots 

         

        You can try by analysing your traffic , check if each hit has one visits =page views = unique visitor, avg time spent is almost zero, and there a high page views in a visit

        Also, you can check if this traffic is coming in a specific hour 

         

        Here is the documentation on common bot signatures that can help you in identifying your traffic as bot

         

        https://experienceleague.adobe.com/docs/analytics/admin/admin-tools/bot-removal/bot-signatures.html?lang=en

         

        Hope this helps

          Pablo_Childe
          Community Advisor
          Pablo_ChildeCommunity Advisor
          Community Advisor
          September 16, 2021

          Seems like 2 diff marketing department yours and some other groups are adding tracking IDs.

           

          I think in this case check are your desired IDs populating as expected? Check in network tab the beacon. If yes then its just a matter of filtering these URLs not desired I believe.

          Terms & ConditionsAccessibility statement

          Loading footer...