Suspicious Email Open and Click Stats

[blakeeaton]

We have seen rising open and click numbers on our emails over the past month or so, culminating in a send this morning that claims the following in the email performance report:

1115 delivered, 1063 opens, 1057 clicks

Even considering we may be doing a wonderful job with our email marketing, these numbers are completely unrealistic. After looking into several dozen leads that clicked on this email, their activity logs all look something like this: 

They have a "Send Email" and "Email Delivered" line, then strangely NO "Open Email" line, followed by multiple "Click Email" lines that abruptly end about 30-40 minutes after delivery. All of the time stamps are different, but the pattern is consistent throughout all leads we checked. 

I've never seen anything like this and it doesn't really align with normal bot activity I'm familiar with (seeing email delivered, opened, and clicked tags all at the same timestamp, for example). But I'm certain this isn't legitimate data.

Has anyone else seen something similar? Any thoughts on what might be causing this?

Thanks so much!

[SanfordWhiteman]

---

They have a "Send Email" and "Email Delivered" line, then strangely NO "Open Email" line...

---

That in itself isn’t strange: a mail scanner looking for suspicious links — as is certainly behind this — has no need to download images.

Are all the Click Email activities for the same link in the email?

[Darshil_Shah1]

---

I've never seen anything like this and it doesn't really align with normal bot activity I'm familiar with (seeing email delivered, opened, and clicked tags all at the same timestamp, for example). But I'm certain this isn't legitimate data.

---

Well, not all email scanners scan the emails in real time - i.e., they don't open / click emails as soon as the email is received in the inbox. Looking at the pattern of activities and same being repeated across dozens of lead do strongly indicate this being the work of email scanners. 

[Katja_Keesom]

Totally agree with @SanfordWhiteman and @Darshil_Shah1 , this is certainly mail scanner activity. That being said, I have not come across this high a level of mail scanner activity in a single target audience yet, but that can vary wildly so is not impossible.

I don't know whether your instance is already capturing bot activities, but it would be worthwile investigating that and at least flagging the activities Marketo can identify as bot activity, so you get at least partial confirmation. As these features will be expanded in the future, it sets you up for being able to filter these non-human interaction out to a larg(er) extent and get more realistic reports.