What is a Spam Appliance?
Email servers use a variety of tools to prevent the delivery of spam messages. Some of these tools will result in inflated, atypical, or suspicious clickthrough data on your Sent Message reports. For example, if your customers use Barracuda Email Security Suite (ESS), it will scan incoming emails and click the first link in each message you send to them. ESS does not identify itself as an email security system (most similar products do), so Act-On does not automatically exclude these clicks.
Typical spam appliance clickthrough activities:
- A high number of clickthroughs on a sent message, often for contacts on the same email domain
- Multiple clicks occurring simultaneously, shortly after the message was sent
- All clicks are for the same link (the first link in your message, often the "View in Browser" link)
- Click data that is clearly incorrect
What can I do?
There are two options to help change your reports to remove spambot activity: ignore known IP addresses for Spambots, or ignore clicks on the View in Browser link altogether.
Ignore clicks on the View in Browser Link from Reports
We do not recommend removing the "View in Browser" link from your Email Header if your goal is to eliminate these spambots' behavior. Instead, you can ignore all clicks on this link using an optional feature.
- Navigate to Settings > Labs
- Toggle to enable Don't record 'view in browser' link as a click
Performing this change will not remove email clicks from existing reports. The reports can only be changed moving forward.
Ignore Known IP Addresses
Common IP Addresses to Ignore
|
Barracuda ESS Barracuda US
Barracuda UK
Barracuda DE (Germany)
*The range 64.235.144.0-64.235.159.255 is automatically ignored for all accounts created after May 2017. |
|
Palo Alto Networks
|
|
Others These IP addresses have been associated with abnormal click activities in the past:
|
Find & Ignore Scanner IPs from your reports (Data Studio, advanced)
If you have the Data Studio add-on feature, pull an Email clickthrough report that includes the IP address field. These are the IP addresses connected to your email clicks.
To confirm whether these clicks are coming from a security provider, verify their MX record information.
- Use Nslookup in your command line/terminal (Windows steps here)
- When prompted, add the IP address and domain name for the contact(s) responsible for the clicks
- Check the data that comes back - it should include the name and information of the security provider
- For example, clicks from Barracuda include .ess.barracudanetworks.com
To exclude the false clicks from your email reports, go to Settings > Other Settings > Internal IP Addresses and add the security system's IP addresses. This setting will result in the Sent Message report ignoring clicks associated with these IPs moving forward.
Performing this change will not remove email clicks from existing reports. The reports can only be changed moving forward.
Comments
3 comments
note: We added a feature to allow you to stop recording "view in a browser" links as click.
https://connect.act-on.com/hc/en-us/community/posts/360035928313-Recent-product-updates-re-cap-from-September-26-Webinar
Why wouldn't you have these IP addresses automatically suppressed in the tool for everyone? Is there anyone who would actually WANT to see these clicks show up in their reports?
Hi Tami, thanks for asking. In short, these IP addresses are suggested to suppress because we've seen a pattern of bot-like behavior, but it's ultimately a guessing game. Most of these email filter companies change IPs and do not publish the ranges that they use, so there's always a chance these are not all associated with bots. So it's something we encourage but want to be sure we're flexible to allow you to add or remove as you wish.
Please sign in to leave a comment.