Bot Filtering in Email and Website Activity

Bots have become pervasive across the web and in the world of email marketing.

Email bot activity is commonly benign: organizations leverage bots to pre-scan emails and "click" links in an attempt to ensure landing pages are free of viruses, malware, phishing, or other malicious tactics.

Paminga employs multiple techniques to identify and invalidate email clicks and web page views originating from bot activity. Millions of such interactions are invalidated every month.

How Paminga Identifies Bot Activity

Paminga leverages multiple techniques to identity bot activity in relation to emails and website page views.

Behavioral Patterns

It's fairly common for bots to "act like bots". For example, they will "click" every link in an email in 3 seconds.

Paminga leverages time-series analysis to invalidate clicks that occur in a short duration or in rapid succession.

Unfortunately, some bots do not exhibit this behavior. They insert random delays between clicks, mimicking human behavior.

User Agents

Every device that visits a web page or clicks a link in an email identifies itself with some text that's known as the "User Agent".

Using a search engine, you can type "what's my user agent" to see your User Agent. Here is an example:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Some bots identify themselves directly in the User Agent – they literally have the word "bot" in that text somewhere.

For example, the bot Google uses to "crawl" the web identifies itself as "GoogleBot".

Paminga watches for a large number of known bots, and that list is updated regularly. Email clicks and web page views are invalidated automatically.

IP Addresses

It's fairly common for bots to be hosted using cloud infrastructure. This allows many bots to be identified via their IP addresses.

Paminga maintains a list of 1,000's of IP addresses associated with bot activity. Email clicks and web page views originating from these IP addresses are invalidated automatically.

But invalidating clicks from every IP addresses where we detect bot activity would not be wise.

Many organizations install antivirus/anti-malware tools inside their own networks, in which case, the IP address of the bot is the same IP address of the legitimate human working from that location.

The Challenge In Identifying Bot Activity

The obvious challenge is the massive and ever-growing number of bots, and the variability among them. There is no technology that can identify every bot. It is an ongoing game of cat and mouse.

In addition to variability, bot creators commonly employ tactics to avoid being detected and blocked:

• Bots commonly "spoof" the User Agent to appear to be a human using a web browser. Doing so is trivial
• IP Addresses can be changed at will, and even changed automatically via scripts
• Click timing and patterns can be and commonly are randomized
• Antivirus and anti-malware bots are commonly installed within an organizations own network – the same network (and IP address) that gets associated with your email recipients

Continuous Improvement

Paminga's approach to bot detection and blocking is one of iterative improvement.

Current techniques are reviewed and adjusted multiple times per year.