Bot clicks no longer flagged as bot activity

[BertCB]

Hi,

We’ve noticed something unusual regarding bot activity in Marketo and I’d like to check if others are seeing the same.

In the past, certain click patterns were consistently flagged by Marketo as bot clicks. Recently, we’ve observed that the exact same type of activity is no longer being marked as bot activity, even though the behavior clearly looks automated. What’s more, we are seeing this with the same contacts where bot activity was previously recognized correctly, but is no longer flagged as such.

Some of the unusual characteristics we see are:

• Operating system and IP address changing between clicks.

• Sometimes two opens for the same email: one recorded on Linux and another on Windows.

• The OS switching specifically between Linux desktop and Windows desktop.

• Page views being logged right after the clicks, which doesn’t seem typical for bots.

Are others noticing this kind of behavior as well? Could this be the reason why Marketo is no longer able to flag this as bot activity?

Thanks in advance for your insights.

Best,
Bert

[Christiane_Rode]

I've been seeing the same -- but, the activity I've been seeing hasn't been followed up by a web visit, which helps to flag the activity.  Also, if someone clicks every link your email, probably not human either.

I believe that this activity could be due to Spam Checkers (like Microsoft Defender), where the IP addresses aren't suspicious, per se, but the activity definitely is because it doesn't behave the way a human realistically would.  That may also speak to why you're seeing different OS -- one OS is for the tool, the other is for the person. 

The above could also be why you're seeing a web visit -- one part of the activity was definitely not human, but the other was. 

[BertCB]

Thanks for the insight.

That makes a lot of sense, especially with the different OS changes potentially being tied to tools vs. actual human activity.

The strange thing in this case though, is that for this specific contact we always see the Linux and Windows switches happening within the same minute, and there are always page views recorded.