email bot - fake unsubscribe

We all know that email traffic contains a lot of bot visits, and some bots even visit your product page and continue to visit the billing page, so there are a lot of fake "billing page visits" in your statistics.
My question is, does the bot continue to visit the unsubscribe confirmation page after visiting the unsubscribe page, resulting in a "fake unsubscribe"?

Depends how dumb or smart the bot is and if the unsub is one click or several tabs and pages.

It can happen.

But the other question is why , if you own the server, why would you not block bots as good as possible

Yes, this can happen. Email security bots often click and scan every link including unsubscribe links and may even open the confirmation page. But they usually do not complete multi step actions, so real unsubscribes are typically much lower than the page visit numbers.

Usually no, most bots open and scan links but don’t complete the full unsubscribe confirmation step. However, if you use one-click unsubscribe without confirmation, bots can trigger fake unsubscribes.

It depends on how the unsubscribe flow is built. Simple bots might hit the unsubscribe link, but they usually won’t complete a proper confirmation step if it requires a real action (like a POST request or button click). Fake unsubscribes mostly happen when the process is one-click with no validation. A proper two-step confirmation can reduce that risk significantly.

Thank you, guys

theusualkeysersoze said:

Depends how dumb or smart the bot is and if the unsub is one click or several tabs and pages.

It can happen.

But the other question is why , if you own the server, why would you not block bots as good as possible

Click to expand...

good idea, I'm trying to block bots as much as possible- build bot IP address lists, and redirect them to static pages. how you block bots?

hwp994108018 said:

good idea, I'm trying to block bots as much as possible- build bot IP address lists, and redirect them to static pages. how you block bots?

Click to expand...

If you are using cf for reverse proxies, you can run some queries in traffic Explorer, it has different names depending on the sub tier, there you have to know how tonidentify the bots, it's not too hard if you never dealt with, but the configuration is a little bit hard. If you wanna start a haf or wtb thread I can set that up for you, else you'll have to ask an llm gtp and take it from there.

Without cf, run your own detection, cf kinda does pretty okay and filters half of them out, but only half, if you run your own , you also need to know what to look for, bots and bot like traffic come in variable signatures and patterns, all obvious in hindsight, but takes some work and knowledge.

If using cf , you can present them an invisible turnstile or captcha if they resolve that, block outright.

Rolling your own, I'd block pre defined signatures outright.

That'll sort the vast majority.

If it's your server, I'd also pay attention to ssh brute force attempts and fail2ban these, too.

King Gener said:

Usually no, most bots open and scan links but don’t complete the full unsubscribe confirmation step. However, if you use one-click unsubscribe without confirmation, bots can trigger fake unsubscribes.

Click to expand...

IT agency said:

It depends on how the unsubscribe flow is built. Simple bots might hit the unsubscribe link, but they usually won’t complete a proper confirmation step if it requires a real action (like a POST request or button click). Fake unsubscribes mostly happen when the process is one-click with no validation. A proper two-step confirmation can reduce that risk significantly.

Click to expand...

visitors access the unsubscribe page, click the button and be redirected to the "confirmation page", Should it be enough ? I thought about using Java to filter bots, most bots now are unable to pass Java