Unusual traffic from "Microsoft Corporation"

Question

In the last 8 months or so, I've been noticing an increase in suspect traffic in GA. I first noticed it when we started seeing higher than usual Wyoming traffic. Now, Wyoming has gone from bottom 5 for traffic to regularly appearing in the top 5 and the issue has become substantially worse in the last month or so. I've tracked it back to having really started at the beginning of 2018.

When I started investigating the issue further, I noticed that the unusual traffic all comes from six cities:

• Cheyenne, WY

• Quincy, WA

• Des Moines, IA

• San Antonio, TX

• Washington, VA

• Chicago, IL

A large amount of traffic from these cities as well as traffic that has (not set) for location, lists a service provider of "Microsoft Corporation" in GA. Bounce rates for this traffic don't seem particularly unusual (70-75% for the most part), but average session duration is incredibly low considering that pages/session averages 1.5. This session duration is not in line with all other traffic (average for the site is about 1 min, 40 sec). I have set GA to not include known bots and spiders.

The traffic does seem to correspond to days when emails are sent for the most part, and clicks on the email and sessions recorded in GA do tend to align pretty well. So even though it looks like a bot, my concern is that it is somehow legit traffic that is simply being recorded incorrectly in GA (location, session duration). I don't know if that's even possible, though.

Does anyone know what this traffic is? I don't want to exclude it without understanding what it is. I have included a screenshot of a custom report that shows the traffic for the last week.

Answer 1

One more thing you can check is screen resolution, i have had similar issues on some of the sites but it was Facebook instead of Microsoft. The screen resolution was 2000x2000 with 100% bounce rate. Than it is easier for exclusion as well.

Answer 2

As per the resources available under this specific topic on the internet it seems these are the traffic coming from Microsoft's Bing search engine bot. You can easily identify/verify them using the following ways.

Try to pull the access log information for one of these request and get the IP address of that specific access log entry. Then you can try to verify it using following verification tool.

Bingbot : https://www.bing.com/toolbox/verify-bingbot

If you need to remove these bot traffic from your Google Analytics reports you have to enable bot filtering option in your GA property view settings.

tick the Exclude all hits from known bots and spiders to remove these traffic from your view.

Answer 3

Those are hits from Microsoft Cloud. They could be bots, and could be not. I would decide whether to exclude them on their monetary value (revenue, leads, any other kind of conversion). If they convert - don't exclude, if not - exclude.

Answer 4

Set the service provider as the primary dimension and see if you can find something interesting using the other dimensions. I would check the browsers, devices, IP addresses, screen resolutions, where the traffic is coming from, and other engagement metrics. If it is a bot it will be very similar.

It could be a VPN service?

Answer 5

We were having the same issue, however Analytics was no longer showing any values for "Service Provider" - fortunately all our 100% bounce rate traffic was coming from extremely old versions of Chrome, eg a quarter of our traffic suddenly came from "Chrome/64.0.3282.140". This made it easy to track down to two blocks of IP addresses: 40.74.0.0 - 40.125.127.255 and 20.33.0.0 - 20.128.255.255

We added in IP blocks to Apache via .htaccess which removed it.

deny from 20.33.0.0/16
deny from 20.34.0.0/15
deny from 20.36.0.0/14
deny from 20.40.0.0/13
deny from 20.48.0.0/12
deny from 20.64.0.0/10
deny from 20.128.0.0/16
deny from 40.74.0.0/15
deny from 40.76.0.0/14
deny from 40.80.0.0/12
deny from 40.96.0.0/12
deny from 40.112.0.0/13
deny from 40.120.0.0/14
deny from 40.124.0.0/16
deny from 40.125.0.0/17

Looking at the access.log's for these IPs and browser versions, it does appear to be an actual Chrome browser being used, connecting on HTTP/2, following redirects, downloading JS/CSS/images. Very confusing as to what would be generating all this traffic and why.