Spam filters registering clicks? | Community
Skip to main content
May 20, 2014
Solved

Spam filters registering clicks?

  • May 20, 2014
  • 15 replies
  • 29146 views
Has there been any problems with spam filters scanning emails and registering clicks as they follow the links in the email?  We are getting false positives on our email clicks.
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by

There are several posts here on Marketo about this issue, and my firm has been digging into it a lot over the last few days. The short answer is that yes, this does indeed happen - spam filters (like Barracuda) / bots / junk mail algorithms do indeed click on links in emails (see this interesting blog post from 2013 regarding the issue - Barracuda calls this "multilevel intent analysis"). The spam filter is looking for redirection or malware or something like that. There isn't a whole ton that we marketers can do about it, though. Here is what we've done and found:

  • First thing we did was download the entire Marketo activity log using the API, put it in a database, and started dissecting the "Click Email" event types. We also sat down with the system administrator here to review some of this data. In short: there is nothing in the User Agent, Platform, Device, etc. that will help spot these.
  • Then we started looking at the timing: what about people who click before they open? What about people who click really quickly after the "Send Email" activity is logged? Well...the "Send Email" event isn't indicative of when, exactly, the email leaves Marketo's servers, so that's not really accurate - you can't spot bots based on that.
  • The best way we've found right now is to include a one-pixel picture / link on the email - invisible to just about everyone (as suggested here). Anything that clicks on such a tiny little pixel you can consider a bot. True; someone might not load images and see a box, but most people won't see it at all.
  • Another possibility: see if you have a bunch of clicks that all happen at the same time (or people clicking every link in an email, every week - would a real person really need to read your Privacy Policy week-in and week-out?). Those are probably bots...but I personally would want to download the data into a real database before attempting this kind of query.
  • One more (really complex) possibility: when we went to our sysadmin (the guy who runs our own company's Barracuda machine) about a lot of these issues, he started to "ping" some of the IP addresses included in the suspicious "Click Link In Email" activities. One or more of them shot back a response indicating that it was a Barracuda box. If you are really, super-duper concerned with this problem, it should be possible to download all Marketo activities via the API and write some custom script / code to extract the IP addresses from the Marketo "Click Email" events and then to periodically ping all these servers to see if you can get them to self-identify as a spam filter (parse the text-strings of the responses for incriminating evidence).

We have not done this last thing, as our "one-pixel" solution has indicated (at least over the last two weeks) that it's likely not a major issue. Perhaps some day, when our organization has unlimited resources (heh), we will pursue this last option, but the reality is that we have a lot going on and better things to do to add more value to our marketing efforts.

I would also like the data to exist in a perfect world - one where our Users validate our TRON Data Discs and we can take down the evil Master Control Programs while we're on our light-cycles on the grid - but that gleaming world of perfect, neon data does not exist. For most of us, I would guess this statistical aberration will not significantly affect our analysis of content effectiveness.

Hope this helps.

15 replies

Benjamin_Ortiz1
New Participant
September 26, 2017

I see what you're saying - I guess my question should be, is using the above filter/trigger combo the most reliable solution known today to attempt to filter out bot clicks? and are there any known issues with tracking marketo hosted pages where I would miss out on real clicks by using this filter/trigger combo?

SanfordWhiteman
New Participant
September 26, 2017

If you only use this for links that run Munchkin (i.e. direct binary downloads won't have a Visited Web Page) then you will only miss people who use tracking protection plugins/features.

I don't consider there to be any reliable detection method for mail scanner clicks, for good reason.

Robb_Barrett
New Participant
July 20, 2017

Not an official person, but if you see a "Clicks Link" without a "Visits Web Page" you've got yourself a spambot.

Robb Barrett
SanfordWhiteman
New Participant
July 21, 2017

(Unless you're offering direct download links.)

Dan_Stevens_
New Participant
July 21, 2017

Which you should always try to avoid - and instead, use this fantastic technique: http://blog.teknkl.com/stop-using-direct-download-links-unless-you-like-losing-tracking/

Dan_Stevens_
New Participant
July 20, 2017

Just a quick note - we've been emailing pretty aggressively with Marketo support regarding this issue. We also found out that MANY other ESPs provide this "click filtering" as part of their service because it happens so often to folks. We recently spoke with about 8-10 other ESPs that automatically (and very easily) filter these clicks for their clients. Marketo deliverability team assured that their are now working with the product side to try to implement this ASAP, especially because so many people are asking about it - KEEP ASKING!

It's been about 16 months since the post was made.  Can anyone from the Marketo product team chime in and let us know if an enhancement to more accurately track valid email clicks?

Robb_Barrett
New Participant
December 29, 2016

@Sanford Whiteman​ - just had a thought I'd like to bounce off of you:

Somewhere near the bottom, create a link with style="display: none;" so no one would see it or find it without reading the code. This would mean any click on the link or visit to the page would be a machine.

Robb Barrett
December 29, 2016

That's a really cool idea! I thought the link has to be on top of the page though?
I can give it a try and see what the result's like.

Thanks!

Julia

Robb_Barrett
New Participant
December 29, 2016

Yeah, upon second thought it should be at the top so it's the first thing clicked or one of the First.

Robb Barrett
December 28, 2016

Hi Matt,

Thanks for the solution! I wasn't able to find the url link for the 1 pixel picture. Is there a specific link that needs to be added or can it be any link we set?

Thanks,
Julia

December 28, 2016

Matt Roberts​ question above for you

Robb_Barrett
New Participant
June 20, 2016

Spam spam spam eggs spam spam spam

Here's something I put together on how to find link scanners / Spam traps.

Robb Barrett
Devraj_Grewal
New Participant
June 15, 2016

I provided a couple of workarounds for this issue on my discussion topic: Email was clicked before it was delivered? It's a link scanner

Carmi_Lopez-Jo1
New Participant
April 6, 2016

Thanks to @Kiersti Esparza​, Manager of Privacy/Deliverability at Marketo, who has just posted a community article on this topic.  Understanding a Spike in Click Activity

Cheers!

Carmi

Robb_Barrett
New Participant
April 4, 2016

This is the same thing I'm seeing on spam traps too. You get a flurry of clicks and few VWPs.

Robb Barrett
Robb_Barrett
New Participant
April 4, 2016

OK, here's a situation I was presented with this morning:

We use Marketo for our Contact Us page and we have workflows that fire off alerts. One of the alerts has two links: I've Handled This, or I Need to Re-Route This. There is a follow up workflow that is triggered on the I've Handled This click.  One of my colleagues asked for help because a click is firing off the follow-up workflow 4 times.

One of the logs I looked at shows the initial alert delivered Sunday night.  On Monday morning, the alert was clicked at 10:34am and there was a corresponding VWP.  Then, also at 10:34 I see two more Clicks Link and only one VWP.

My first thought is that I have a double-clicker. I created a lead for myself following the process.  I was very slow about waiting to click on the link the first time. I did, it registered one click, one VWP, then nothing more. I put in a filter for Not Clicks Link In Email in Past 1 minute to see if that would help.  Then, about 5 minutes after my first click I double clicked. It registered two clicks and two VWPs.

A minute later, it registered 3 clicks and 1 VWP. These were not by me or anyone else.

Now, it's work noting that we have a URLDefensePoint system in place. All links in emails are re-coded by the server with DefensePoint to check. I'm thinking that it's testing the link for us to see what happens prior to allowing the browser to go to the link.

Thoughts?

@Sanford Whiteman​

Robb Barrett
SanfordWhiteman
New Participant
April 4, 2016

Now, it's work noting that we have a URLDefensePoint system in place. All links in emails are re-coded by the server with DefensePoint to check. I'm thinking that it's testing the link for us to see what happens prior to allowing the browser to go to the link.

I think you're correct.

And this is a case where, unlike inbound scanners I know of, the outbound/opt-in service can afford to perform deep scanning because they only see a subset of links. That is, they are actually following the JS redirect, so they generate a Visit Web Page as well as a click. (Inbound scanners can't afford to do this because from a defensive programming standpoint they could tie up their own resources.)