Skip to main content

How to identify bot activity

Updated

What is bot activity?

Bot activity can generate a large number of campaign events within a very short time. This often affects clicked and opened statuses.

It may look like this:

bot_activity_events.png

Identify bot activity

Check event timestamps

Check whether events occur within milliseconds. Humans cannot generate click events in such quick succession. Even opening multiple tabs and switching between them takes more time.

Check event attributes

Compare the attributes of suspected bot clicks with attributes from user clicks. If the bot generates too many events, check other events, such as session_start, which also tracks IP addresses.

Check IP addresses

Copy the IP address from a suspicious event into an external IP lookup or reputation service. Check whether it belongs to a cloud provider, a proxy, a VPN, or a security-scanning service.

Use the IP address as supporting evidence, not as proof.

Avoid filtering an IP address only because it belongs to a different city or country. Customers may use VPNs, corporate networks, mobile carrier gateways, or privacy relays.

Find affected customer profiles

Use a funnel to measure how many customers generate the same event pattern within a short time period.

Set the funnel time period in the top-right corner. For example, set it to one minute and add several events. If only a very small percentage of customers, such as up to 1% or 5%, match the funnel, bot activity is more likely than a platform issue:

Handle bot activity

The bot usually runs on the customer’s side, for example, in an email service provider such as Gmail. You cannot remove it directly.

Prevent further emails to an affected customer

To prevent further emails to an affected customer, use one of these options:

  • Add the customer profile to a blocklist.

  • Set the email_invalid customer property to true.

Handle other types of bot activity

For other types of bot activity:

  • Contact Support if a scraper bot generates hundreds of thousands of website events.

  • Prevent the customer profile from triggering campaigns if a bot repeatedly clicks a subscription button, triggering consent or campaign events.

Other examples of bot activity

Bot activity is not limited to campaign events. A scraper bot can navigate through your website at an inhuman speed and generate large numbers of events. A bot can also repeatedly click a subscription button, triggering a campaign each time.

Campaign events are commonly affected because bots often run on customers’ email service providers.

Use the checks in this article to identify whether unusual activity comes from a bot or a genuine customer action.

Summary

Bot activity can generate campaign and website events at an inhuman speed. Use event timestamps, attributes, IP addresses, and behavioral patterns to identify it, then restrict access to affected profiles.