In the last 8 months or so, I've been noticing an increase in suspect traffic in GA. I first noticed it when we started seeing higher than usual Wyoming traffic. Now, Wyoming has gone from bottom 5 for traffic to regularly appearing in the top 5 and the issue has become substantially worse in the last month or so. I've tracked it back to having really started at the beginning of 2018.
When I started investigating the issue further, I noticed that the unusual traffic all comes from six cities:
Cheyenne, WY
Quincy, WA
Des Moines, IA
San Antonio, TX
Washington, VA
Chicago, IL
A large amount of traffic from these cities as well as traffic that has (not set) for location, lists a service provider of "Microsoft Corporation" in GA. Bounce rates for this traffic don't seem particularly unusual (70-75% for the most part), but average session duration is incredibly low considering that pages/session averages 1.5. This session duration is not in line with all other traffic (average for the site is about 1 min, 40 sec). I have set GA to not include known bots and spiders.
The traffic does seem to correspond to days when emails are sent for the most part, and clicks on the email and sessions recorded in GA do tend to align pretty well. So even though it looks like a bot, my concern is that it is somehow legit traffic that is simply being recorded incorrectly in GA (location, session duration). I don't know if that's even possible, though.
Does anyone know what this traffic is? I don't want to exclude it without understanding what it is. I have included a screenshot of a custom report that shows the traffic for the last week.