# Event traffic anomaly investigation sheet

Use one sheet per launch or on-sale anomaly. Keep security logs in their approved system; record aggregate evidence and references here. A suspicious analytics pattern is a question, not a bot verdict.

| Question | Answer / evidence link | Owner |
|---|---|---|
| Event, launch window and time zone | [ ] | [ ] |
| Exact metric and route with unexpected change | [ ] | [ ] |
| Comparable prior window and why it is comparable | [ ] | [ ] |
| Related registration starts, completed orders and check-ins | [ ] | [ ] |
| Campaign, press, release, tag, consent or test change | [ ] | [ ] |
| Possible duplicate analytics event or internal job | [ ] | [ ] |
| Edge/application request volume and response codes, same route/time | [ ] | [ ] |
| Known crawler or monitor explanation | [ ] | [ ] |
| Evidence against the leading explanation | [ ] | [ ] |
| Unknowns or missing data | [ ] | [ ] |

## Decision record

Classification: [likely automation / measurement error / legitimate campaign / unresolved].

Evidence supporting it: [ ]. Alternative explanation checked: [ ]. Confidence and limitations: [ ].

Reporting action: [annotate only / fix instrumentation / compare a report slice / ask security to assess request controls]. Owner and review date: [ ].

If a reported number was adjusted, record the original metric, rule, affected period and adjusted metric. Do not permanently exclude GA4 data merely to make a chart look clean; active data filters can permanently prevent matching events from being processed. An analytics filter does not block web requests. Do not use geography, one user-agent or low engagement alone to block visitors.