2

Question about Personalization Builder - Collect Tracking Security:

When users go on a webpage with collect tracking code implemented, they send an invisible tracking pixel via the basic javascript code. Inside of it is some content depending on what actions you have done (trackpageview item, URL etc). The browser of the client sends the pixel to SFMC Servers.

Example of a recommendation call:

https://nova.collect.igodigital.com/c2/MID-VALUE/track_conversion?payload=

Example payload (which would follow the above URL):

{
"cart":[{"item":"000000000000001","quantity":"20"}],
"url":"https://www.yourshop.com/checkout",
"user_info":{"email":"a@google.de"}
}

To blow up a recommendation system you basically only need 2/3 things:

  1. Knowledge how the calls of salesforce look like
  2. The MID parameter. Since your MID has to be public inside the source code of your site you can easily find many if you search for it in the right search engines. Inside the following link https://publicwww.com/websites/_etmc.push/ you can find some examples.
  3. Correct Product / Article Numbers

When Predictive Intelligence is connected to your contact model these calls can create contacts and raise your contact count that you might surpass your contact limit (which would also increase your monthly payment to salesforce).

How can you guard yourself against malicious persons that try to blow up your recommendation system by faking these calls? They can fake conversions/page visits .... basically everything. Your recommendation system will most likely deliver bad recommendations and your implementation is completely worthless.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.