Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
BedrockMission!

Learn more

View all

Sign in to view all badges

Microsoft Bots overwritting URL parameter values

EggBoy
Level 3
Level 3

Hi Awesome Brain Trust of Adobe Analytics (ABToA),

 

We are observing some visits where our campaign tracking code parameter values (in our case 'xcid') and even some Google UTM parameter values contain values that are not generated by our team (for that we use Claravine/TrackingFirst).

 

Has anyone else seen anything like this?

 

The look auto-generated...and until earlier this year were only a few hundred visits/month, but this year we are seeing a jump to over 5,000 per month.

 

They are being overwritten from tactics in all channels from google and bing advertising to emails we've sent out via Marketo.

 

We've tracked the IP addresses and they all seem to be coming from Microsoft IPs, so we assume it is some kind of bot.

Here are some examples of the variants...the numeric part will have tons of values so the seem to be auto generated:

b-b_48882
ccd-ccd_31350

dbagc-ace_48167
fkg0039

fz-6eec_54792
fz-be_31072

fz-ge_bdbeg

 

Most seem to come from MS domains:

EggBoy_0-1631716266767.png

URL examples:

EggBoy_1-1631716471051.png

 

For now we will put hits from the IP addresses we've ID'd into our 'exclude bot' segment.

 

Any thoughts?

 

Thanks!

 

 

6 Replies
suneeshkachroo
Level 4
Level 4

One thing that can be tried is  checking for UserAgent string for the traffic 

EggBoy
Level 3
Level 3

Hi, don't see anything out of the ordinary for useragent...pretty much reflects most of our traffic:

EggBoy_0-1631903383851.png

 

PratheepArunRaj
Moderator
Moderator

Dear EggBoy,

Sorry, not sure on the above but sounds interesting.

Unable to see them as BOTS because I think that is something to do with authentication or some identifier auto appended by Marketo or Microsoft mail engine such as hotmail or live (A random thought).

Whats the device contribution? Is it only from Mobile Phone or around all the devices?

Should simulate the same to have better understanding.

Thank You, Pratheep Arun Raj B | Xerago | Terryn Winter Analytics 

 

EggBoy
Level 3
Level 3

Hi @PratheepArunRaj seems to be all desktop. For Marketo, I did check those URLs and they were definitely overwritten from the original value (we tokenize that in the Marketo program). The URLs involved seem to be MOSTLY our homepage, in one of it's EN versions, or the main page of our blog...with a few other odd/random URLs in there too for some promo pages...strange and mysterious.

EggBoy_1-1631904159344.png

 

Vani_Bhemarasetty_Adobe
Level 4
Level 4

@EggBoy In order to check if these hits are bots 

 

You can try by analysing your traffic , check if each hit has one visits =page views = unique visitor, avg time spent is almost zero, and there a high page views in a visit

Also, you can check if this traffic is coming in a specific hour 

 

Here is the documentation on common bot signatures that can help you in identifying your traffic as bot

 

https://experienceleague.adobe.com/docs/analytics/admin/admin-tools/bot-removal/bot-signatures.html?...

 

Hope this helps

pabloc82923542
Level 8
Level 8

Seems like 2 diff marketing department yours and some other groups are adding tracking IDs.

 

I think in this case check are your desired IDs populating as expected? Check in network tab the beacon. If yes then its just a matter of filtering these URLs not desired I believe.