Review / bot / test traffic identified in FunnelFlux
Stored BEFORE each wipe so the evidence survives. Source: campaigns/research/review-traffic/review_traffic.json via scripts/funnelflux/review_traffic_db.py. Updated 2026-09-04 00:49 UTC.
2live-ms-ip
16own-test
2review
20total
Microsoft Ads review traffic - Tier 1 gate (defined 2026-09-04; reporting only (label / exclude); NOT for content routing)
ALL THREE true on the landing hit => REVIEW
- 1. msclkid (URL param; FunnelFlux external): absent / empty
- 2. URL-suffix tracking fields adgroupid, ad, campaign (FunnelFlux c3, c4, campaign): ALL empty (not a literal macro, not a numeric id)
- 3. visitor IP: Microsoft-owned: ISP resolves to 'Microsoft Corporation' OR in scripts/funnelflux/ms_review_ips/ tier 2 (corp) or tier 3 (public / Azure)
Explicit non-matches
- msclkid present (32 hex) on ANY IP incl. Microsoft → LIVE click - keep (3 Sep: 2 such visits, one was the MaxWeb sale)
- no msclkid, residential / mobile-carrier IP → LIVE click with the id stripped - keep (3 Sep: 10 of 356)
- literal macro text such as {AdId} in a tracking field, any IP → BOT / automated fetcher - label bot, not review
Confidence boosts (not conditions)
- arrives within minutes of a submission, edit or appeal
- arrives while the ad has zero impressions
- user agent changes between landing hit and CTA click
- desktop Edge/Chrome from a datacenter city (Quincy WA, Boydton VA, Des Moines IA, San Antonio TX, Cheyenne WY)
Evidence: 2026-09-03/04 WL lander: review visits 70.37.26.145 + 72.152.84.254 matched all three; 3 Sep burst 344/356 live clicks matched none; see visits below
Planned use: once the account serves again: tag matching visits in FunnelFlux reporting (e.g. a tracking-field label) so reviewable vs real traffic is visible; same page for everyone
| Label / first seen | IP / owner / tier | UA | URL params | Funnel / path | Context |
|---|---|---|---|---|---|
| own-test 2026-09-04 00:45:53 UTC |
unrecorded |
Desktop / |
msclkid no suffix no c3 - c4 - |
Sciatica - NewsBreak (2026) offer no converted no |
Direct desktop load of the NB funnel with no URL parameters (empty external + all tracking fields) while the ad set was being re-enabled 4 Sep 10:38 / 10:46 Melb; no real click id. Recorded from the raw-event scan after the wipe (the add step failed on a shell quirk), so IP/UA are unrecorded. wiped: yes 2026-09-04T00:49:00Z 1 events2026-09-04 00:45:53 hit Kinzeno Advertorial SAFE (NewsBreak) (default route) Desktop/ c3=- c4=- msclkid=no |
| own-test 2026-09-04 00:40:13 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Apple iPhone / iOS 18.5 / Mobile Safari SmartPhone / iOS |
msclkid yes suffix yes c3 ios c4 1001 |
Sciatica - NewsBreak (2026) offer yes MW - Kinzeno - Massage Gel converted no |
Claude final routing test of the review-traffic router after the v01 rename: exact ad URL with literal macros + bare link -> /sciatica-fix-nb-v01 (node 3xCn2UYg6oJD); live-shaped click (nvss_E2ETEST... id, numeric ids, NB SDK UA) -> /sciatica-fix-nb (node 3xCeTt1HL2Fu); CTAs 301 to MaxWeb 12620 (hop not followed); wiped after wiped: yes 2026-09-04T00:40:48Z 5 events2026-09-04 00:40:13 hit Kinzeno Advertorial (NewsBreak) SmartPhone/iOS c3=ios c4=1001 msclkid=yes 2026-09-04 00:40:13 hit Real click? SmartPhone/iOS c3=ios c4=1001 msclkid=yes 2026-09-04 00:40:13 hit Traffic SmartPhone/iOS c3=ios c4=1001 msclkid=yes 2026-09-04 00:40:18 hit MW - Kinzeno - Massage Gel SmartPhone/iOS c3=ios c4=1001 msclkid=yes 2026-09-04 00:40:18 click Kinzeno Advertorial (NewsBreak) SmartPhone/iOS c3=ios c4=1001 msclkid=yes |
| own-test 2026-09-04 00:40:10 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Apple iPhone / iOS 19.3.1 / Mobile Safari SmartPhone / iOS |
msclkid no suffix no c3 - c4 - |
Sciatica - NewsBreak (2026) offer yes MW - Kinzeno - Massage Gel converted no |
Claude final routing test of the review-traffic router after the v01 rename: exact ad URL with literal macros + bare link -> /sciatica-fix-nb-v01 (node 3xCn2UYg6oJD); live-shaped click (nvss_E2ETEST... id, numeric ids, NB SDK UA) -> /sciatica-fix-nb (node 3xCeTt1HL2Fu); CTAs 301 to MaxWeb 12620 (hop not followed); wiped after wiped: yes 2026-09-04T00:40:48Z 5 events2026-09-04 00:40:10 hit Kinzeno Advertorial SAFE (NewsBreak) SmartPhone/iOS c3=- c4=- msclkid=no 2026-09-04 00:40:10 hit Traffic SmartPhone/iOS c3=- c4=- msclkid=no 2026-09-04 00:40:10 hit Real click? SmartPhone/iOS c3=- c4=- msclkid=no 2026-09-04 00:40:13 hit MW - Kinzeno - Massage Gel SmartPhone/iOS c3=- c4=- msclkid=no 2026-09-04 00:40:13 click Kinzeno Advertorial SAFE (NewsBreak) SmartPhone/iOS c3=- c4=- msclkid=no |
| own-test 2026-09-04 00:40:07 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Unknown Unknown / Windows 10 / Chrome Desktop / Windows |
msclkid yes suffix yes c3 __OS__ c4 __CREATIVE_NAME__ |
Sciatica - NewsBreak (2026) offer yes MW - Kinzeno - Massage Gel converted no |
Claude final routing test of the review-traffic router after the v01 rename: exact ad URL with literal macros + bare link -> /sciatica-fix-nb-v01 (node 3xCn2UYg6oJD); live-shaped click (nvss_E2ETEST... id, numeric ids, NB SDK UA) -> /sciatica-fix-nb (node 3xCeTt1HL2Fu); CTAs 301 to MaxWeb 12620 (hop not followed); wiped after wiped: yes 2026-09-04T00:40:48Z 5 events2026-09-04 00:40:07 hit Traffic Desktop/Windows c3=__OS__ c4=__CREATIVE_NAME__ msclkid=yes 2026-09-04 00:40:07 hit Kinzeno Advertorial SAFE (NewsBreak) Desktop/Windows c3=__OS__ c4=__CREATIVE_NAME__ msclkid=yes 2026-09-04 00:40:07 hit Real click? Desktop/Windows c3=__OS__ c4=__CREATIVE_NAME__ msclkid=yes 2026-09-04 00:40:10 hit MW - Kinzeno - Massage Gel Desktop/Windows c3=__OS__ c4=__CREATIVE_NAME__ msclkid=yes 2026-09-04 00:40:10 click Kinzeno Advertorial SAFE (NewsBreak) Desktop/Windows c3=__OS__ c4=__CREATIVE_NAME__ msclkid=yes |
| own-test 2026-09-04 00:38:10 UTC |
unrecorded |
Desktop / |
msclkid no suffix no c3 - c4 - |
Sciatica - NewsBreak (2026) offer no converted no |
Direct desktop load of the NB funnel with no URL parameters (empty external + all tracking fields) while the ad set was being re-enabled 4 Sep 10:38 / 10:46 Melb; no real click id. Recorded from the raw-event scan after the wipe (the add step failed on a shell quirk), so IP/UA are unrecorded. wiped: yes 2026-09-04T00:49:00Z 1 events2026-09-04 00:38:10 hit Kinzeno Advertorial SAFE (NewsBreak) (default route) Desktop/ c3=- c4=- msclkid=no |
| own-test 2026-09-04 00:30:06 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Unknown / |
msclkid yes suffix yes c3 ios c4 - |
Sciatica - NewsBreak (2026) offer no converted no |
6 bare-UA curl routing checks of the safe route after repointing it to /sciatica-fix-nb-v01 (research session) wiped: yes 2026-09-04T00:30:43Z 3 events2026-09-04 00:30:06 hit Kinzeno Advertorial (NewsBreak) Unknown/ c3=ios c4=- msclkid=yes 2026-09-04 00:30:06 hit Real click? Unknown/ c3=ios c4=- msclkid=yes 2026-09-04 00:30:06 hit Traffic Unknown/ c3=ios c4=- msclkid=yes |
| own-test 2026-09-04 00:30:06 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Unknown / |
msclkid yes suffix yes c3 ios c4 - |
Sciatica - NewsBreak (2026) offer no converted no |
6 bare-UA curl routing checks of the safe route after repointing it to /sciatica-fix-nb-v01 (research session) wiped: yes 2026-09-04T00:30:43Z 3 events2026-09-04 00:30:06 hit Traffic Unknown/ c3=ios c4=- msclkid=yes 2026-09-04 00:30:06 hit Kinzeno Advertorial (NewsBreak) Unknown/ c3=ios c4=- msclkid=yes 2026-09-04 00:30:06 hit Real click? Unknown/ c3=ios c4=- msclkid=yes |
| own-test 2026-09-04 00:30:05 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Unknown / |
msclkid no suffix no c3 - c4 - |
Sciatica - NewsBreak (2026) offer no converted no |
6 bare-UA curl routing checks of the safe route after repointing it to /sciatica-fix-nb-v01 (research session) wiped: yes 2026-09-04T00:30:43Z 3 events2026-09-04 00:30:05 hit Kinzeno Advertorial SAFE (NewsBreak) Unknown/ c3=- c4=- msclkid=no 2026-09-04 00:30:05 hit Traffic Unknown/ c3=- c4=- msclkid=no 2026-09-04 00:30:05 hit Real click? Unknown/ c3=- c4=- msclkid=no |
| own-test 2026-09-04 00:30:05 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Unknown / |
msclkid no suffix no c3 - c4 - |
Sciatica - NewsBreak (2026) offer no converted no |
6 bare-UA curl routing checks of the safe route after repointing it to /sciatica-fix-nb-v01 (research session) wiped: yes 2026-09-04T00:30:43Z 3 events2026-09-04 00:30:05 hit Traffic Unknown/ c3=- c4=- msclkid=no 2026-09-04 00:30:05 hit Kinzeno Advertorial SAFE (NewsBreak) Unknown/ c3=- c4=- msclkid=no 2026-09-04 00:30:05 hit Real click? Unknown/ c3=- c4=- msclkid=no |
| own-test 2026-09-04 00:30:05 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Unknown / |
msclkid yes suffix yes c3 __OS__ c4 - |
Sciatica - NewsBreak (2026) offer no converted no |
6 bare-UA curl routing checks of the safe route after repointing it to /sciatica-fix-nb-v01 (research session) wiped: yes 2026-09-04T00:30:43Z 3 events2026-09-04 00:30:05 hit Kinzeno Advertorial SAFE (NewsBreak) Unknown/ c3=__OS__ c4=- msclkid=yes 2026-09-04 00:30:05 hit Traffic Unknown/ c3=__OS__ c4=- msclkid=yes 2026-09-04 00:30:05 hit Real click? Unknown/ c3=__OS__ c4=- msclkid=yes |
| own-test 2026-09-04 00:30:04 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Unknown / |
msclkid yes suffix yes c3 __OS__ c4 - |
Sciatica - NewsBreak (2026) offer no converted no |
6 bare-UA curl routing checks of the safe route after repointing it to /sciatica-fix-nb-v01 (research session) wiped: yes 2026-09-04T00:30:43Z 3 events2026-09-04 00:30:04 hit Traffic Unknown/ c3=__OS__ c4=- msclkid=yes 2026-09-04 00:30:04 hit Kinzeno Advertorial SAFE (NewsBreak) Unknown/ c3=__OS__ c4=- msclkid=yes 2026-09-04 00:30:04 hit Real click? Unknown/ c3=__OS__ c4=- msclkid=yes |
| own-test 2026-09-04 00:20:01 UTC |
115.70.61.59Ryan's connection (Melbourne) Melbourne, Victoria, AU own |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1 SmartPhone (Playwright iPhone UA) / iOS |
msclkid no suffix yes c3 ios c4 - |
Sciatica - NewsBreak (2026) offer yes MW - Sciaticyl (301 Location read from the safe page CTA) converted no |
Claude E2E of the condition router v2 (external not empty AND no __): 1 hit each of nvss_e2eclaude20260904b / abc123futureformat / __CALLBACK_PARAM__ / empty / bare root, + safe-page action/1 fetch wiped: yes 2026-09-04T00:22:30Z 1 events2026-09-04 00:20:01..00:20:14 hit x5 + click x1 2x Kinzeno Advertorial (NewsBreak) / 3x HSI - Sciatica Safe v0 (NewsBreak) SmartPhone/iOS c3=- c4=- msclkid=no |
| own-test 2026-09-04 00:16:11 UTC |
115.70.61.59Ryan's connection (Melbourne) Melbourne, Victoria, AU own |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1 SmartPhone (Playwright iPhone UA) / iOS |
msclkid no suffix yes c3 ios c4 - |
Sciatica - NewsBreak (2026) offer yes MW - Sciaticyl (301 Location read from the safe page CTA) converted no |
Claude E2E of the condition router v1 (external contains nvss_): 2 hits each of external=nvss_e2eclaude20260904 / __CALLBACK_PARAM__ / empty / absent / bare root link, + safe-page action/1 fetch (redirect not followed) wiped: yes 2026-09-04T00:19:30Z 1 events2026-09-04 00:16:11..00:16:31 hit x10 + click x1 2x Kinzeno Advertorial (NewsBreak) / 8x HSI - Sciatica Safe v0 (NewsBreak) SmartPhone/iOS c3=- c4=- msclkid=no |
| own-test 2026-09-04 00:07:45 UTC |
115.70.61.59Ryan's connection (Melbourne) Melbourne, Victoria, AU own |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1 SmartPhone (Playwright iPhone UA) / iOS |
msclkid no suffix no c3 - c4 - |
Sciatica - NewsBreak (2026) offer yes (click event recorded) converted no |
Two hits + one click with EMPTY external from our IP at 10:07 Melb while Ryan was editing the funnel in the FF UI (ad set OFF, no paid traffic possible); seen by session 0affiliate-63, cleared by 0affiliate-93 wiped: yes 2026-09-04T00:23:00Z 3 events2026-09-04 00:07:45 hit SmartPhone/iOS c3=- c4=- msclkid=no 2026-09-04 00:07:58 hit SmartPhone/iOS c3=- c4=- msclkid=no 2026-09-04 00:07:58 click SmartPhone/iOS c3=- c4=- msclkid=no |
| own-test 2026-09-03 23:55:54 UTC |
115.70.61.59Ryan's connection (Melbourne) Melbourne, Victoria, AU own |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1 SmartPhone (Playwright iPhone UA) / iOS |
msclkid no suffix yes c3 ios c4 - |
Sciatica - NewsBreak (2026) offer yes MW - Kinzeno - Massage Gel (301 Location read, MaxWeb hop not followed) converted no |
Claude E2E of the 50/50 root rotation after adding the Kinzeno advertorial node: 8 root /fts/ hits (external=e2e-claude-20260904, c1=E2ETESTSET, c2=E2ETESTAD) + 1 action/1 fetch with redirect not followed wiped: yes 2026-09-03T23:58:00Z 1 events2026-09-03 23:55:54..23:56:10 hit x8 + click x1 6x HSI - Sciatica Ugly Group / 2x Kinzeno Advertorial (NewsBreak) SmartPhone/iOS c3=- c4=- msclkid=no |
| review 2026-09-03 23:26:21 UTC |
72.152.84.254Microsoft Corporation Des Moines, Iowa, US 72.152.84.254 3_public |
Apple Unknown / Mac 10.15.7 / Chrome Desktop / Mac |
msclkid no suffix no c3 - c4 - |
Weight Loss - Search 2026 offer yes MW - Slim Boost Tea converted no |
Microsoft Ads support review of the WL strike appeal: two Microsoft-owned IPs 15 s apart, ~6 min after Ryan submitted; bare final URL (no suffix, no msclkid); one walked lander -> CTA -> Slim Boost Tea wiped: yes 2026-09-04T00:18:56Z 4 events2026-09-03 23:26:21 hit Belly Fat Lazy Way (Microsoft) Desktop/Mac c3=- c4=- msclkid=no 2026-09-03 23:27:12 hit MW - Slim Boost Tea Desktop/Windows c3=- c4=- msclkid=no 2026-09-03 23:27:12 hit Offers Desktop/Windows c3=- c4=- msclkid=no 2026-09-03 23:27:12 click Belly Fat Lazy Way (Microsoft) Desktop/Mac c3=- c4=- msclkid=no |
| review 2026-09-03 23:26:06 UTC |
70.37.26.145Microsoft Corporation Quincy, Washington, US 70.37.26.145 3_public |
Unknown Unknown / Windows 10 / Microsoft Edge Desktop / Windows |
msclkid no suffix no c3 - c4 - |
Weight Loss - Search 2026 offer no converted no |
Microsoft Ads support review of the WL strike appeal: two Microsoft-owned IPs 15 s apart, ~6 min after Ryan submitted; bare final URL (no suffix, no msclkid); one walked lander -> CTA -> Slim Boost Tea wiped: yes 2026-09-04T00:18:56Z 1 events2026-09-03 23:26:06 hit Belly Fat Lazy Way (Microsoft) Desktop/Windows c3=- c4=- msclkid=no |
| own-test 2026-09-03 23:16:01 UTC |
115.70.61.59SUPERLOOP (AUSTRALIA) PTY LTD Melbourne, Victoria, AU 115-70-61-59.ip4.superloop.au 115.70.61.59 - 115-70-61-59.ip4.superloop.au |
Apple Unknown / Mac 10.15.7 / Chrome Desktop / Mac |
msclkid no suffix no c3 - c4 - |
Weight Loss - Search 2026 offer yes MW - Slim Boost Tea converted no |
Ryan's own loads of the live compliant lander via Arc (09:16 + click-through 09:22 Melb) after the swap wiped: yes 2026-09-04T00:18:56Z 4 events2026-09-03 23:16:01 hit Belly Fat Lazy Way (Microsoft) Desktop/Mac c3=- c4=- msclkid=no 2026-09-03 23:22:33 hit MW - Slim Boost Tea Desktop/Mac c3=- c4=- msclkid=no 2026-09-03 23:22:33 hit Offers Desktop/Mac c3=- c4=- msclkid=no 2026-09-03 23:22:33 click Belly Fat Lazy Way (Microsoft) Desktop/Mac c3=- c4=- msclkid=no |
| live-ms-ip 2026-09-03 12:07:19 UTC |
20.141.51.111Microsoft Corporation Boydton, Virginia, US 20.141.51.111 2_corp |
Unknown Unknown / Windows 10 / Microsoft Edge Desktop / Windows |
msclkid yes suffix yes c3 1238051725607020 c4 77378378652023 |
Weight Loss - Audience 2026 offer yes MW - SodaTide converted yes |
COMPARISON, KEPT: real audience-ad clicks from Microsoft-owned IPs during the 3 Sep first-serve burst (msclkid + ad ids present); 20.141.51.x is the MaxWeb CPA sale tx 123598 wiped: no (kept) 8 events2026-09-03 12:07:19 hit Belly Fat Lazy Way (Microsoft Audience) Desktop/Windows c3=1238051725607020 c4=77378378652023 msclkid=yes 2026-09-03 12:12:47 hit Offers Desktop/Windows c3=1238051725607020 c4=77378378652023 msclkid=yes 2026-09-03 12:12:47 hit MW - SodaTide Desktop/Windows c3=1238051725607020 c4=77378378652023 msclkid=yes 2026-09-03 12:12:47 click Belly Fat Lazy Way (Microsoft Audience) Desktop/Windows c3=1238051725607020 c4=77378378652023 msclkid=yes 2026-09-03 13:25:37 hit Offers Desktop/Windows c3=1238051725607020 c4=77378378652023 msclkid=yes 2026-09-03 13:25:37 hit MW - SodaTide Desktop/Windows c3=1238051725607020 c4=77378378652023 msclkid=yes 2026-09-03 13:25:37 click Belly Fat Lazy Way (Microsoft Audience) Desktop/Windows c3=1238051725607020 c4=77378378652023 msclkid=yes 2026-09-03 13:29:42 conversion MW - SodaTide Desktop/Windows c3=1238051725607020 c4=77378378652023 msclkid=yes |
| live-ms-ip 2026-09-03 12:01:53 UTC |
20.65.14.65Microsoft Corporation Boydton, Virginia, US 20.65.14.65 3_public |
Unknown Unknown / Windows 10 / Microsoft Edge Desktop / Windows |
msclkid yes suffix yes c3 1238051725607020 c4 77378378652025 |
Weight Loss - Audience 2026 offer no converted no |
COMPARISON, KEPT: real audience-ad clicks from Microsoft-owned IPs during the 3 Sep first-serve burst (msclkid + ad ids present); 20.141.51.x is the MaxWeb CPA sale tx 123598 wiped: no (kept) 1 events2026-09-03 12:01:53 hit Belly Fat Lazy Way (Microsoft Audience) Desktop/Windows c3=1238051725607020 c4=77378378652025 msclkid=yes |