SOLVED

Yet another question about BOT activity

Go to solution
Tracy_Boesken
Level 3

Yet another question about BOT activity

Has anyone else experienced BOT opens and not clicks?

Usually, by checking the activity I can identify BOTS due to the actions but this email send it seems many of the 137 opened were from the same domain and

Platform: unknown

Device: unknown

Screenshot 2021-07-20 125519.png

 

 

Would this be BOT activity, inflated/false opens?

So my question is: are there BOT mail scanners that open only and do not click?

 

Thanks,

--Tracy

1 ACCEPTED SOLUTION

Accepted Solutions
SanfordWhiteman
Level 10 - Community Moderator

Re: Yet another question about BOT activity


So my question is: are there BOT mail scanners that open only and do not click?


Yes, in fact Apple is deliberately converting to a prefetch-every-link model in order to preserve anonymity. That is, since everyone appears to “open,“ you can’t distinguish one human activity from another.

View solution in original post

6 REPLIES 6
SanfordWhiteman
Level 10 - Community Moderator

Re: Yet another question about BOT activity


So my question is: are there BOT mail scanners that open only and do not click?


Yes, in fact Apple is deliberately converting to a prefetch-every-link model in order to preserve anonymity. That is, since everyone appears to “open,“ you can’t distinguish one human activity from another.

Tracy_Boesken
Level 3

Re: Yet another question about BOT activity

Thank you!

Tracy_Boesken
Level 3

Re: Yet another question about BOT activity

To detect bot open (not clicks) activities that are occurring in some email deployment, I've added steps to detect and isolate based on the timing of the open. My concern is that multiple triggers are attempting to fire at the same time (the "Wait" step is only in the flow.) Does this look like it will work:

 

Global Bots Identification Program:

Trigger Clicks honeypot link in email

Flow Change Data Value Is Bot True

 

Local Program Bots Cleanup:

Trigger Listens for Data Value Change Is Bot True,

Filter Email Address Contains (known domains or individual email addresses), and Filter Member of (this) Program True

Flow Add to List (static Honeypot list w/in program), Remove from (this) campaign if Bot True

 

Local Program Bots known opens:

Trigger Listens for Opens (this) Email in past 8 minutes

Filter Email Address Contains (known) domain

Flow Remove from flow this campaign, Add to List (static Honeypot list w/in program)

 

Local Program Opened Email  Campaign:

Trigger Listens for Opens Email is (this email)

Filter Member of List NOT in static Honeypot List, and Filter Blacklisted False

Flow Wait 1 hour, Change Program Status If Is Bot is False new status is Email Blast > Opened

 

Local Program Clicked Email  Campaign:

Trigger Listens for Clicks Link in Email, this email, link is not honeypot link (any other link on page),

Filter Blacklisted False

Flow Wait 1 hour and 30 minutes, Change Program Status If Is Bot is False new status is Email Blast > Clicked

 

Local Program Converted  Campaign:

Trigger Listens for Clicks Link in Email, this email, link is CTA link,

Filter Member of List not in static Honeypot list, Filter Email Address not contains (our company domain)

Flow Change Program Status Email Blast > Converted (then additional flow steps blah, blah)

 

Suggestions? Thanks,

--Tracy

SanfordWhiteman
Level 10 - Community Moderator

Re: Yet another question about BOT activity

Quite honestly I wouldn’t vouch for any of this. May work, may catch some mail scanner activity, definitely not all, and adds a tremendous amount of complexity.
Tracy_Boesken
Level 3

Re: Yet another question about BOT activity

Thanks @SanfordWhiteman we are trying to provide answers to the higher-ups.

When there is a wait step in the flow does it delay the trigger?

Thanks,

--Tracy

SanfordWhiteman
Level 10 - Community Moderator

Re: Yet another question about BOT activity


When there is a wait step in the flow does it delay the trigger?

No, it does not. The flow starts when the triggering activity occurs.