AnsweredAssumed Answered

Fake clicks from SPAM filters - is there an end in sight?

on Jan 30, 2019
Latest reply on Jun 10, 2019 by John Horton

Like • Show 9 Likes9
Comment • 25

It looks like other systems are solving the issue of fake clicks, specifically ones that come occur because SPAM filters click every link to make sure none are malicious.

There is already an idea asking for this functionality: https://nation.marketo.com/ideas/7095#comment-35229

There are a few discussions that can help you identify if a click is real or fake: Bot or Not? – Are you suffering from ‘bot clicks’? Fake clicks followed by fake web visits Spam filters registering clicks?

This discussion is to generate ideas for how we (or engineers!!) can identify fake clicks to remove them from reporting. Things like...if you get an open or a click (or multiple clicks) before the email is delivered...it implies something!

Amy Goldfine recommended all links clicked in the same minute be excluded - no human does that. Or excluding certain links like the header. (Christina here - why do we link the header if no one clicks it?!)

Brooke Bartos pointed out that clicking every social link never happens IRL. Too true.

Do you have a suggestion? Jump in!

3 people also have this question

Outcomes

25 Replies

Amy Goldfine Jan 30, 2019 1:45 PM
Mark Correct
Correct Answer
We don't have the granularity to view this in Marketo's UI, but my guess is that all link clicks are very close together in the same minute. Perhaps even in the same second. I don't think we can use that data in Marketo via the UI, but there must be a way for Marketo to see that on the back end! Our lead scoring is all messed up because of this, and it's giving false information to Sales—and making them not trust us!
Like • Show 2 Likes2
Actions
- Chris Wilcox @ Amy Goldfine on Jan 30, 2019 1:52 PM
  Mark Correct
  Correct Answer
  Hey Amy,
  
  Not sure if it's a viable solution, but we have audience segments where auto-clicks are a HUGE problem. We've switched instead to utilizing the web page view activity to trigger those lead scoring and lead management workflows. We need to do some additional work on our end by filtering web page views using the querystring associated with particular campaigns, but we have found this to drastically cut down the false-click scoring. Our audience is B2B, and the technologies they use for SPAM monitoring do NOT appear (in my own experience) to trigger the Marketo "page view" activity to be trigger, or for GA data to be impacted. I've heard others on this board state differently, but that's our audience/experience. Message me if you want to chat through our solution.
  
  Thanks,
  Chris
  Like • Show 0 Likes0
  Actions
Chris Wilcox Jan 30, 2019 1:55 PM
Mark Correct
Correct Answer
I, like many, am constantly fighting this in our instance. Bot clicks are a serious source of frustration for our marketers who are sometimes getting a skewed perspective of results. Of COURSE, I am fully on board with a built-in Marketo solution to help address and normalize real-person activity and that of spam filtering technology. But that being said, part of me thinks there is no permanent solution. If an email marketing platform can easily understand what activities are being driven by a bot or triggering a bot to scan/click/etc., wouldn't someone with malicious intent be able to use the same exact information to avoid the can/spam checkers from the get go, and/or be able to react differently to a bot response than they do to a real person response? I.e. be a nice safe website with no code injecting or phishing scams present for bot traffic, but then presenting a different experience to people? I know I'm being overly simplistic, but doing this accurately and forever seems like a pipe dream.

I'm probably not thinking about a lot of things correctly, but as much as I would absolutely utilize and cherish this feature, I just don't see it being a holistic and viable long-term ask of Marketo. At least, not without direct cooperation of those can spam technology companies.
Like • Show 1 Like1
Actions
Brooke Bartos Jan 30, 2019 2:54 PM
Mark Correct
Correct Answer
We have a surpression Smart List that tracks clicked more than 5 links in 2 minutes without an email open, then excludes those people from running through the scoring campaign until after 2 minutes. It's not perfect, but it helps. Stops the worst offenders at least.
8 people found this helpful
Like • Show 2 Likes2
Actions
Andy Varshneya Jan 30, 2019 3:41 PM
Mark Correct
Correct Answer
Going off of volume of clicks, frequency of clicks, or even the link clicked isn't a viable solution because with thousands of customers sending out thousands of emails a year, there will bound to be scenarios where each of those was the desired behavior and we'll end right back up over here but with the opposite problem of Marketo not counting real clicks.

Instead, I would suggest looking at the order of events. SPAM filtering servers often ghost click the links to validate there is no malicious intent, but without registering opens, so one solution would be to not count clicks unless the email has also been already opened. Alternatively, if the link is for your own domain, don't count the click unless the web page visit is also logged. This isn't a fully comprehensive solution since GDPR and cookie-enablement could prevent this from being error-free, not to mention not every link is for your own domain.

Another interesting solution is that Marketo white-labels 250ok for it's email deliverability metrics. It could tap into that existing relationship and only count clicks if the email also has a successful delivery.

Ultimately, systematically solving this problem would require building for all corner cases not just the mean, so better understanding all of the root causes would help provide for a more informed decision regarding possible solutions. However, human behavior can't dictate the solution since that behavior itself isn't consistent across the millions of email recipients.
1 person found this helpful
Like • Show 1 Like1
Actions
Rachit Puri Jan 30, 2019 7:43 PM
Mark Correct
Correct Answer
Here's an helpful article that explains how email clicks are fake - https://www.demandlab.com/insights/blog/want-believe-email-link-clicks-arent-real/
Like • Show 0 Likes0
Actions
- Dan Stevens. @ Rachit Puri on Jan 30, 2019 8:15 PM
  Mark Correct
  Correct Answer
  There was an active discussion last February regarding Courtney’s blog post: Re: [Shared Blog]: I Want to Believe, But: Your Email Link Clicks Aren’t Real
  Like • Show 1 Like1
  Actions
  - Chris Wilcox @ Dan Stevens. on Jan 31, 2019 7:49 AM
    Mark Correct
    Correct Answer
    To piggy back off of that other discussion and Courtney's article, we've also used filter constraints using querystring parameters to identify true clicks as well. In the article/discussion it's pretty well agreed to use web page views as a 'true' indicator of clicking, but if a campaign includes multiple web pages you need to add those every time to every trigger. Since we're already tagging URLs for GA, we can use any web page visit that includes the correct source/medium combination for our GA tracking to know if any given page view was directed via an internally distributed marketing email. This allows a 'catch all' to score those engagements.
    
    In practice, we have different scoring rules based on the content that was engaged with, so we have multiple of these 'catch all' filters running for each of the groups of content and their relative score values, but we've had decent success with this setup. Obviously all depends on your instance and use case!
    Like • Show 0 Likes0
    Actions
Nithish Bhat Feb 1, 2019 3:53 AM
Mark Correct
Correct Answer
We implemented a simple solution for SPAM Clicks. If there are more than 3 clicks in the same email. We dont consider it. We built a smart campaign around it.
Like • Show 0 Likes0
Actions
David Gallagher Feb 1, 2019 12:20 PM
Mark Correct
Correct Answer
There are numerous ways to resolve this. I decided to rely on program statuses and did the following:
1. I updated my email templates to include 2 linked pixels. one at the very top and one at the very bottom of said email template.
2. each of those pixels were hard linked to our homage with utm tokens added
3. I updated the utm_term to read ...&utm_term=clicked-top--{{my.utm_term}} and ...&utm_term=clicked-bottom--{{my.utm_term}} respectively.
4. updated smart campaign filter: I made sure to exclude anyone who clicked a link containing utm_term=clicked-top or utm_term=clicked-bottom in the past 1 minute .
Additionally, I also added anyone who clicked those links to a global list for safe keeping -- this was mainly as a sanity check to know who's email clients were click-happy.

Whether right wrong or indifferent it worked for me...
Like • Show 1 Like1
Actions
- Sanford Whiteman @ David Gallagher on Feb 1, 2019 12:29 PM
  Mark Correct
  Correct Answer
  Linked to your... home page? That means the mail scanner needs to do more work and every send puts more load on your webserver (50,000 emails could == 50,000 hits).
  
  The effectiveness of this method aside, you don't need to link to an extant page to test it. The Clicked Email activity is registered for URLs that do not exist in any publicly-accessible way.
  Like • Show 0 Likes0
  Actions
  - David Gallagher @ Sanford Whiteman on Feb 1, 2019 2:09 PM
    Mark Correct
    Correct Answer
    Keep in mind this was my solution almost a year ago with a small db. One thing I did notice is that the link click was tracked in Marketo, but I never saw anyone actually hit the page with that link -- then again that was in Marketo "viewed page" and not GA. Good point Mr. Whiteman . badidea
    Like • Show 0 Likes0
    Actions
    - Sanford Whiteman @ David Gallagher on Feb 1, 2019 2:16 PM
      Mark Correct
      Correct Answer
      Right, even if the hit wasn't logged to GA or Marketo, i.e. not via JS, it's placing load on your webserver (not necessarily fetching secondary assets but fetching the main document). Reminiscent of this: https://blog.teknkl.com/flop-timized-marketo-lps-and-the-case-of-the-350kb-favicon/. In any case, for this particular approach there's no need for a real fetchable URL.
      
      PS. Why not use the link ID instead of UTMs? Same outcome.
      Like • Show 0 Likes0
      Actions
Anne Angele Feb 1, 2019 1:34 PM
Mark Correct
Correct Answer
I'm currently testing a bandaid for reporting and scoring. I created a smart campaign triggered off of an email click OR email delivered with filters saying the click and delivered happened in the last minute with the flow adding them to a static list called "suspected false clicks". I'm going to review the list over the next few weeks and see how accurate what we captured is. I'm debating adding a min of 2-3 clicks as well. If I can narrow it down enough, we can use it to exclude from reporting and scoring.
Like • Show 0 Likes0
Actions
- Sanford Whiteman @ Anne Angele on Feb 1, 2019 1:51 PM
  Mark Correct
  Correct Answer
  But how will you be testing the accuracy?
  
  Problem with a lot (though not all) of these approaches is that you'll have false positives + false negatives but will never know it, by definition.
  Like • Show 0 Likes0
  Actions
  - Anne Angele @ Sanford Whiteman on Feb 1, 2019 2:23 PM
    Mark Correct
    Correct Answer
    Manually reviewing activity logs to check for red flags (click before delivery, similar behavior from all leads at the same company, clicks but no open, etc.) and making a judgment call. There's not a perfect system, of course, but doing nothing is also unreliable. So my goal is just to get it narrowed down to a point where it's at least more reliable than with no intervention.
    
    Frankly, I haven't heard a solution that I'm thrilled with and am all ears if you've got other ideas.
    Like • Show 0 Likes0
    Actions
Debbie Margulies Feb 1, 2019 3:24 PM
Mark Correct
Correct Answer
We have a hidden link at the top of our templates and if that is clicked we know it is a bot and use a smart campaign to remove from flow.

                <tr style="display:none;visibility:hidden;">
                  <td width="1" height="1" style="margin: 0 auto;display:none;visibility:hidden;width:1px;height:1px;" align="center"> <a href="https://www.skyboxsecurity.com/?botlink" style="outline: 0;text-decoration: none;"></a> </td>
                </tr>
1 person found this helpful
Like • Show 0 Likes0
Actions
- Sanford Whiteman @ Debbie Margulies on Feb 1, 2019 5:45 PM
  Mark Correct
  Correct Answer
  This is the same thing David is mentioning, and again you shouldn't be hitting your actual homepage. That could cause a self-DoS.
  Like • Show 0 Likes0
  Actions
  - Frank Elley @ Sanford Whiteman on Feb 7, 2019 11:37 AM
    Mark Correct
    Correct Answer
    So would Debbie's solution work better if the href were a bogus url? It would be terrific if we could get an drop-in example that avoids the potential drawbacks. Thanks!
    
    (And just BTW: it's not just spam filters doing this. Increasingly, AI-based email solutions are reading content in order to tag and organize it recipients. Not pertinent to the solution here, but there might eventually be an avenue to understand how email content can play nicely with these as well.)
    Like • Show 0 Likes0
    Actions
    - Sanford Whiteman @ Frank Elley on Feb 7, 2019 11:55 AM
      Mark Correct
      Correct Answer
      So would Debbie's solution work better if the href were a bogus url?
      Yes, although it's not an all-around solution, more a way to throw some more babies out with the bathwater.
      Like • Show 0 Likes0
      Actions
Courtney Grimes Feb 11, 2019 2:59 PM
Mark Correct
Correct Answer
So, I just want to quickly note here that we've discovered a new type of anti-spam checking behavior over the past several days that conventional methods have a hard time capturing. Rather than fire around the time of delivery, it fires on a recurring basis, presumably until the recipient actually opens the emails and clicks on any links. From an antispam point of view, this makes sense--you can't bait and switch the URL contents after delivery--but it's massively annoying to find. I'm trying to come up with a predictable way of catching this outside of IP traffic so it can be managed via Marketo, but it may be a bit until there's a bulletproof way to catch this.
2 people found this helpful
Like • Show 2 Likes2
Actions
- Anne Angele @ Courtney Grimes on Feb 12, 2019 11:59 AM
  Mark Correct
  Correct Answer
  Thank you for sharing this. I'm going to poke around and see if any of our clients are experiencing that.
  Like • Show 0 Likes0
  Actions
  - Sanford Whiteman @ Anne Angele on Feb 12, 2019 12:46 PM
    Mark Correct
    Correct Answer
    I'm going to poke around and see if any of our clients are experiencing that.
    Periodic rescanning isn't a brand-new thing, btw. Services have been doing this for 10 years or more, just not in conjunction with the headless browser environments that now enable the scanning to be more accurate.
    Like • Show 0 Likes0
    Actions
- Sanford Whiteman @ Courtney Grimes on Feb 12, 2019 12:12 PM
  Mark Correct
  Correct Answer
  There won't be a way to catch this. Whole idea is it's indistinguishable from normal HTTP traffic.
  
  You have to mandate a human-only type of interaction (like waiting until somebody has clicked a button, then retroactively noting that they clicked the email link that led to the page with the button). Any unattended interaction can be forged.
  Like • Show 0 Likes0
  Actions
John Horton Jun 10, 2019 5:08 PM
Mark Correct
Correct Answer
It's unbelievable to me that Marketo hasn't found a way to fix this yet. It's been a known issue for well over a year now. These fake clicks make the analytics useless. You'd think it would be a top priority to find a real solution other than end-user workarounds.
Like • Show 2 Likes2
Actions

Incoming Links

Re: Most recent lead activity

Fake clicks from SPAM filters - is there an end in sight?

Outcomes

Related Content

Recommended Content

Incoming Links