Yet another question about BOT activity

[Tracy_Boesken]

Has anyone else experienced BOT opens and not clicks?

Usually, by checking the activity I can identify BOTS due to the actions but this email send it seems many of the 137 opened were from the same domain and

Platform: unknown

Device: unknown

Would this be BOT activity, inflated/false opens?

So my question is: are there BOT mail scanners that open only and do not click?

Thanks,

--Tracy

[SanfordWhiteman · Accepted solution]

---

So my question is: are there BOT mail scanners that open only and do not click?

---

Yes, in fact Apple is deliberately converting to a prefetch-every-link model in order to preserve anonymity. That is, since everyone appears to “open,“ you can’t distinguish one human activity from another.

[Tracy_Boesken]

Thank you!

[Tracy_Boesken]

To detect bot open (not clicks) activities that are occurring in some email deployment, I've added steps to detect and isolate based on the timing of the open. My concern is that multiple triggers are attempting to fire at the same time (the "Wait" step is only in the flow.) Does this look like it will work:

Global Bots Identification Program:

Trigger Clicks honeypot link in email

Flow Change Data Value Is Bot True

Local Program Bots Cleanup:

Trigger Listens for Data Value Change Is Bot True,

Filter Email Address Contains (known domains or individual email addresses), and Filter Member of (this) Program True

Flow Add to List (static Honeypot list w/in program), Remove from (this) campaign if Bot True

Local Program Bots known opens:

Trigger Listens for Opens (this) Email in past 8 minutes

Filter Email Address Contains (known) domain

Flow Remove from flow this campaign, Add to List (static Honeypot list w/in program)

Local Program Opened Email  Campaign:

Trigger Listens for Opens Email is (this email)

Filter Member of List NOT in static Honeypot List, and Filter Blacklisted False

Flow Wait 1 hour, Change Program Status If Is Bot is False new status is Email Blast > Opened

Local Program Clicked Email  Campaign:

Trigger Listens for Clicks Link in Email, this email, link is not honeypot link (any other link on page),

Filter Blacklisted False

Flow Wait 1 hour and 30 minutes, Change Program Status If Is Bot is False new status is Email Blast > Clicked

Local Program Converted  Campaign:

Trigger Listens for Clicks Link in Email, this email, link is CTA link,

Filter Member of List not in static Honeypot list, Filter Email Address not contains (our company domain)

Flow Change Program Status Email Blast > Converted (then additional flow steps blah, blah)

Suggestions? Thanks,

--Tracy

[SanfordWhiteman]

Quite honestly I wouldn’t vouch for any of this. May work, may catch some mail scanner activity, definitely not all, and adds a tremendous amount of complexity.

[Tracy_Boesken]

Thanks @SanfordWhiteman we are trying to provide answers to the higher-ups.

When there is a wait step in the flow does it delay the trigger?

Thanks,

--Tracy

[SanfordWhiteman]

---

When there is a wait step in the flow does it delay the trigger?

---

No, it does not. The flow starts when the triggering activity occurs.