Email Bots Logging Web Activity - HELP

[Adele_Miller]

Hi Champs!

I am hoping someone can help me as I am on the verge of screaming at this issue

We have an issue with email bots / spam checkers clicking every single link on some of our emails before delivering them to the real recipients inbox.

We used to filter these out by no web activity being logged as the bots couldn't log that but recently we have noted they can now log activity against each lead and Support have confirmed this....GRRR!!

We use Sales Insight so this is giving a lot of false positives to sales to follow up on and we want to work out a way to filter this out.

Anyone else having this issue and have some fun ways to resolve it please??

[Marisa_Rybar]

I am having issues with bots clicking AND opening emails. I've stopped scoring email opens, and I'm only scoring email clicks very selectively.

However, now my concern is in email reporting. If I can see on the individual activity logs that an email is being opened before it's being delivered, is that counting as an open in my overall email report? So, for example, I had a newsletter go out this morning. Marketo is telling me it had a 29.1% open rate and a 7.9% click to open rate, but which of these are real opens & clicks, and which of them were bots? I'm having a really hard time trusting the data I'm seeing right now.

[Devraj_Grewal]

Marisa,

Correct, if the click and open activity is from a bot or a human, it will still show in the activity log and an email report. What I would recommend is using "member of smart campaign" for the scoring clicks smart campaign and filtering by those in the email report. So then the report only includes people who had at least validated activity enough for the scoring.

[Marisa_Rybar]

I'm sorry, Devraj, but I don't understand what you're saying. The only people who received this email were members of the smart campaign that sent the email, so it doesn't change the numbers at all whether I look at this from the Email tab on the smart campaign or whether I look at this from the Email Performance Report where the parameters are this specific email in the Setup tab and the Smart List logic specifies members of the smart campaign that sent the email this morning.

Would you mind please being more clear? The bots from the emails of the people on this smart list are the ones doing the activity, so I don't see any way of distinguishing between the bot and the human. The only way I could fathom doing this would be to set parameters that say not to score something if it is opened or clicked on before the email is delivered, but that capability doesn't currently exist as far as I can tell.

Thanks for the ideas and insights!

[Devraj_Grewal]

Sorry about that confusion. Basically what I had accomplished is something similar, where I stopped scoring for email opens and only scored for email clicks if there was subsequent email click and visit webpage activity, another layer of validation that it was a human and not a bot. However, when an email report is run, it will still include all opens and clicks, humans and bots. So what I do is for the email report's smart list, I make sure that people were members of the scoring campaign for email clicks since those are the most trustworthy clicks. The result is that only those people who have clicked and visited a page will be included in the email report. I don't report on email opens anymore since it is not an accurate metric at all.

[Marisa_Rybar]

Ah, I see. That makes sense! Too bad we can't use this reporting anymore. I hope Marketo comes out with a solution soon!

[Adele_Miller]

To refer you both to my original post I am afraid you could still be getting false positives with this workaround. The bots are now able to log web activity when they click all links, Support confirmed this for me as we had the same workaround in place as you are discussing.

[Michael_Oslin]

Hi Adele Miller​

We just started noticing the same thing, clicks and web page visits. Our landing page metrics were great, but when we started digging into them they were all visits from email clicks by bots. Usually occurring in rapid succession right after the send.

So we are a bit at a loss, it seems like all our metrics are over inflated and we don't have a plan to curtail this problem.

I've been trying to implement solutions but every solution we deploy seems to have a "gotcha" or is not comprehensive or encompassing enough to avoid this over-inflation.

It seems like its a prevalent problem and something that could hurt the credibility of our reports dramatically, I'm hoping Marketo is taking a close look at this.

Have you figured out any type of solution since your original post?

Thank you-

Michael

[Hana_AlBarazi]

Hi Michael,

TLDR: Put dummy-links in your emails to capture bots .

We have realized that around 90% of clicks in our emails are bots! We came to this conclusion after having the same problem you described. For a work-around, we implemented a hidden section in all of our emails that includes a transparent pixel image, which dummy-links to our homepage and has a utm code of "bot" added to the URL. We have inserted the code pasted below above our email banner, so it's the first link in all emails, but only a computer can see it because it's technically hidden from view. 

<div class="mktEditable" id="HiddenLink" >

<center>

<span style="display: none; visibility: hidden; overflow: hidden;"><a href="http://www.homepage.com/?&utm_click=bot"><img src="Marketo_image_link_TransparentPixel-01.png"></a>

</span>

</center>

</div>

Then, we have two different reports/smart lists: clicks with bots, and clicks without bots. Because we have the "http://www.homepage.com/?&utm_click=bot" link, we can tell any smart list or report to count all of the clicks on that link, which we are assuming is a bot. We also have a smart list filters that will remove that "person" from the report if they've also clicked on any other link in the email, so we aren't accidentally discounting real people clicking.

The reporting is a manual process, which I think Marketo could definitely implement some out-of-the-box solutions (including making the dashboard view customizable to modify filters to exclude or include bot-clicks: ) - but if you make the bot link default in email templates, that helps.

I'm not a Marketo guru, so I'm not sure if you can include the dummy link in landing page click reporting. For example, counting if a person clicked on the dummy link, and also clicked on a link in a landing page, then they are a bot, etc. But obviously the timing of those clicks matters a lot - and I don't think Marketo can filter reports on that level of granularity yet. It sounds like this question is the bread and butter of this thread, but I wanted to throw in our work-around related to this issue in case it helps other people.

Let me know if you have any additional questions!

-Hana

[SanfordWhiteman]

...if they've also clicked on any other link in the email, so we aren't accidentally discounting real people clicking.

This doesn't make sense. Mail scanners also click on other links in the email (otherwise they have no purpose) so you aren't excluding them.

I have to tell you that this approach, which has been attempted by many, does not work.  You're getting a false assurance.

[Hana_AlBarazi]

Hi Sanford, thanks for the feedback. I'm a little new to the scene with these types of things, so forgive me if that's showing through!

So, it sounds like the real issue is the timing of the clicks, then? We need a better way to determine clicks that happen within the first seconds of the email being delivered (could be bots) versus anytime after that (could be humans).

[SanfordWhiteman]

So, it sounds like the real issue is the timing of the clicks, then? We need a better way to determine clicks that happen within the first seconds of the email being delivered (could be bots) versus anytime after that (could be humans).

Yes and no. The timestamp of an individual click isn't going to give the context you want. It's (at best) about the the timing of a batch of clicks.  If clicks were queued up for a short period of time, rather than being sent to the tracking server immediately, then the rate/breadth of a batch could be analyzed. The whole batch would be thrown out if it seems machine-made, or the whole batch forwarded to Marketo otherwise.

Yet this, too, isn't foolproof, since sometimes a mail scanner will only click one of your links, if it's still within the cache lifetime of the other links (they do cache results for a short period of time).

There's a foolproof way (using external tech, but simple) to tell whether a human clicked on an email if you can get them to engage further.  That is, if someone fills out a form on the CTA target page, or even just goes to another page on your site, then you can see a trustworthy Clicked Email activity for the specific link in a specific email. But if they merely view the immediate target page and don't do anything else, it's still nearly impossible.

[Hana_AlBarazi]

Right, that makes sense.

I've thought about it more, and I do think that setting up a dummy link in emails the way I described is helpful, but mostly in determining the variance of how many clicks could be due to bots - not necessarily in providing exact numbers.

For example, we sent an email recently that included the dummy link. I created a smart list that included all people that only clicked on the dummy link, and the number was about ~900. Then I created a smart list that included clicks on any other link besides the dummy link, and the number dropped to ~200. This means that even if a percentage of those 900 people who have bots scanning their emails do actually convert to real clicks when that person opens the email and clicks, it's still a helpful data point for us to see what the spread is.

It may not be an exact science, but it has helped our team re-consider our baseline and targets for email engagement.

Thanks again for the thoughtful responses and feedback.

[SanfordWhiteman]

I think you're misinterpreting what's probably happening with your dummy link. The link is itself arousing suspicion -- never a good thing for deliverability -- because it appears to be hidden (note that no link is ever actually hidden -- in my mail client, for example, I'm sure your CSS or whatever you're using to hide will have no effect and I'll see it plain as day). As a result it's scanned more often than the others, which can make more use of cached results. That's inflating the level of scrutiny by mail scanners, so you're moving the goalposts (if you will) just by including the link.

Since slightly after the dawn of spam, we spamfighters (I'm also a mailserver admin from way back) have looked as much for attempts to obfuscate malicious content as we have for the content itself. That is, it can be easier for anti-abuse systems to detect that you're trying to hide something than it is to figure out what makes it worth hiding. So really, the whole idea of a "hidden" link is counter to the goal of successful email marketing.

[Hana_AlBarazi]

Sanford,

That's actually fantastic feedback, and it makes a lot of sense. I wonder if simply removing the "hidden" css would make it any different. I definitely hear your point about tracking web activity, and whether a desired action was taken to gauge campaign success over clicks, and I agree that's the best way to go. It's just tough to let go of clicks as a reliable metric!

Thanks for being so thorough with your explanations.

[Eunice_Leung]

Hi Adele,

May I ask what solution Support has provided to you? I have the following rules in place but like many have mentioned before, these do not quarantine bot clicks entirely:

1) In scoring rule, set up filter to do not score clicks on an invisible link in emails we embedded for bots. But bots click on all links in an email. So those clicks are still being scored

2) Still include email performance report in program for product marketers but they love it. But then include a smart list that look at the clicks on the invisible links so they get an idea of what should be "discounted" from the email performance report.

3) Include a landing page performance report - but sounds like it wouldn't work either because bots click through emails now and that actions register in web activity.

In smart list, I can't find a way to look for email clicks happened before email delivery or setting up the minimum number of clicks within a minute. These two are good measures of finding out what clicks are from bots. Has anyone tried this and succeed?

[Anonymous]

Hi Adele-

Does the bot activity also log an open of the email? I've seen this in the past where the bot will click links but won't load all content, so the pixel that triggers an email open never fires. You could filter on people that didn't open the email but clicked to get the bots out.

However, on the other hand, this would filter out people that receive text emails by default. If the bots are really taking a toll, this may be worth the sacrifice.

Thanks,

Keith

[SanfordWhiteman]

However, on the other hand, this would filter out people that receive text emails by default. If the bots are really taking a toll, this may be worth the sacrifice.

And Outlook users!

This is one of many reasons why heuristic detection (and discarding) of mail scanner traffic must be done at the tracking server, whether your own or Marketo's. It'll always fail to some degree, but it'll fail extra hard if you try to jerry-rig it with Marketo's end user tools.

[Anonymous]

Thanks Sanford - quick question on that, why would it filter Outlook users? I haven't hit problems with Outlook users not logging opens in the past. Is it only certain versions of Outlook?

[SanfordWhiteman]

Since at least Outlook 2010, Outlook and Outlook Web Access have required user opt-in to download images.

[Sarah_Lundy1]

Hi Adele,

Can I just ask - how is a bot check actually linking with a true lead? Are you passing to sales leads before firm data collection on industry/name/email address combo for example - would this not exclude the bot crawls linking to lead behaviour?

Thanks

Sarah