Microsoft Bots overwritting URL parameter values

[EggBoy]

Hi Awesome Brain Trust of Adobe Analytics (ABToA),

We are observing some visits where our campaign tracking code parameter values (in our case 'xcid') and even some Google UTM parameter values contain values that are not generated by our team (for that we use Claravine/TrackingFirst).

Has anyone else seen anything like this?

The look auto-generated...and until earlier this year were only a few hundred visits/month, but this year we are seeing a jump to over 5,000 per month.

They are being overwritten from tactics in all channels from google and bing advertising to emails we've sent out via Marketo.

We've tracked the IP addresses and they all seem to be coming from Microsoft IPs, so we assume it is some kind of bot.

Here are some examples of the variants...the numeric part will have tons of values so the seem to be auto generated:

b-b_48882
ccd-ccd_31350

dbagc-ace_48167
fkg0039

fz-6eec_54792
fz-be_31072

fz-ge_bdbeg

Most seem to come from MS domains:

URL examples:

For now we will put hits from the IP addresses we've ID'd into our 'exclude bot' segment.

Any thoughts?

Thanks!

[suneeshkachroo · Accepted solution]

One thing that can be tried is  checking for UserAgent string for the traffic 

[EggBoy]

Hi, don't see anything out of the ordinary for useragent...pretty much reflects most of our traffic:

[PratheepArunRaj]

Dear EggBoy,

Sorry, not sure on the above but sounds interesting.

Unable to see them as BOTS because I think that is something to do with authentication or some identifier auto appended by Marketo or Microsoft mail engine such as hotmail or live (A random thought).

Whats the device contribution? Is it only from Mobile Phone or around all the devices?

Should simulate the same to have better understanding.

Thank You, Pratheep Arun Raj B | Xerago | Terryn Winter Analytics 

[EggBoy]

Hi @PratheepArunRaj seems to be all desktop. For Marketo, I did check those URLs and they were definitely overwritten from the original value (we tokenize that in the Marketo program). The URLs involved seem to be MOSTLY our homepage, in one of it's EN versions, or the main page of our blog...with a few other odd/random URLs in there too for some promo pages...strange and mysterious.

[VaniBhemarasetty]

@EggBoy In order to check if these hits are bots 

You can try by analysing your traffic , check if each hit has one visits =page views = unique visitor, avg time spent is almost zero, and there a high page views in a visit

Also, you can check if this traffic is coming in a specific hour 

Here is the documentation on common bot signatures that can help you in identifying your traffic as bot

https://experienceleague.adobe.com/docs/analytics/admin/admin-tools/bot-removal/bot-signatures.html?...

Hope this helps

[Pablo_Childe]

Seems like 2 diff marketing department yours and some other groups are adding tracking IDs.

I think in this case check are your desired IDs populating as expected? Check in network tab the beacon. If yes then its just a matter of filtering these URLs not desired I believe.