AI-Assisted Email Forensic Analysis

Everyone reports opens. We can prove who was real.

Your platform counts an image loading as a person. In a campaign we audited line by line, 89% of the tracked activity was machines (proxies, scanners, crawlers) and every one of them was reported as engagement. ListRefiner instruments your send with proprietary tracking codes, resolves every hit to an IP, device and origin, then turns the raw forensics into a report your client can read and a strategy you can act on.

Eight minutes. No credit card. You will never look at an open rate the same way.

Live classification. One send, four hits.

13:26:08 · Akamai, Dallasscanner
13:26:11 · Google Image Proxyimage proxy
13:26:13 · Microsoft, no user agentlink scan
13:26:15 · AT&T mobile, Oaklandhuman · bought

What an audited send really contains

Four numbers from one real campaign

We instrumented every link and every image in a live ticketed-event campaign. Then we classified all 1,432 requests that came back, sorting them by user agent, hosting origin and request pattern. Here is exactly what we found. Read the fourth number twice.

89%
Of tracked activity was machines
Mail scanners. Image proxies. Link crawlers. The platform called every one of them a reader.
30%
Of link clicks were not people
Scanners do more than load your images. They follow every URL in the message. Yes, including the unsubscribe link.
85%
Of responding addresses, machine only
274 addresses that no human had ever once opened. Today they sit on a suppression list where they belong.
19×
Better reach on a verified segment
Per address mailed, the human-verified list out-clicked the raw subscriber base nineteen to one.

These figures come from a single client audit and are reported exactly as measured. Your list will look different. That is the entire reason to measure it.

Why nothing else can show you this

An open is just an image loading.

Nobody has to read your email for it to count as opened. Stop and think about that for a moment. A corporate mail filter fetches the image. A webmail proxy fetches the image. An antivirus sandbox fetches the image. Your platform sees the request and records a person. It has no mechanism to strip those hits out, and it will not accept the tracking codes that would let anyone else strip them out either. So the machines pour straight into your open rate, your click rate and your most engaged segment. Every recommendation built on those numbers is built on sand.

  • Every hit resolved to an IP. Carrier, ISP, hosting origin, city, and whether it is residential, datacenter or privacy relay.
  • Mobile and desktop recorded per recipient. In the audit above, half of all genuine traffic came from a phone.
  • Privacy relays kept, never discarded. iCloud Private Relay and WARP users are real buyers. Crude bot filters throw them in the trash.
  • You get the CSV. Not a summary chart. The raw classified rows, yours to segment, suppress and act on.

Classified send log. Excerpt.

TimeOriginDeviceVerdict
19:10:00Cloudflare, LAn/ascanner
12:43:19Fastly, Dallasn/ascanner
11:59:58Google prefetchn/aimage proxy
08:29:48Akamai, San Josen/ascanner
13:26:13Microsoft O365n/alink scan
13:26:15AT&T, OaklandiPhonehuman
15:20:46Comcast, NovatoDesktophuman
14:00:35Comcast, Santa RosaMobilehuman

How ListRefiner works

Clean it. Instrument it. Analyze it. Rebuild it.

Maybe you are switching platforms. Maybe you are waking a list that went cold years ago. Either way the sequence never changes, and at every stage you measure instead of assume.

STEP 01

Clean

Invalid, expired and undeliverable contacts come out before a single message goes anywhere. Zero bounces on every drip-fed send. Guaranteed.

STEP 02

Instrument

Proprietary List Refiner codes go inside the message itself. Now every open and every click comes back carrying an IP, an ISP, a device and a timestamp instead of a bare tally.

STEP 03

Analyze

Every hit is checked against known image proxies, datacenter ranges, privacy relays and security-scanner fleets. Then AI-assisted analysis turns thousands of raw rows into findings a human can actually use.

STEP 04

Rebuild

Drip-fed re-opt-in campaigns, paced to rebuild your sender reputation from the ground up, aimed only at the addresses we have proven a real person sits behind.

Forensics is only the first half

Raw evidence is useless until someone reads it.

One send produces thousands of log rows. No client wants a CSV. No account manager has a week to hand-classify user agents. So the software does the forensics nothing else can do, and AI-assisted analysis turns that pile of rows into the report and the recommendation.

Layer 01

The software does the forensics

Proprietary tracking codes ride inside every message, per recipient. Every request that comes back is captured with its IP, ISP, hosting organization, city, device class and timestamp, then matched against known proxy, datacenter, relay and scanner infrastructure. No mainstream platform will let anyone do this. Not a competitor. Not an agency. Not you.

A verdict on every row
Layer 02

AI-assisted analysis writes the report

The classified data gets read, cross-referenced against the order record, and written up as plain findings. Which sends produced real people. Which segments are dead. Which addresses to suppress. Where the money actually came from. Client-ready, in their language, with the evidence attached.

Raw log to client-ready findings
Layer 03

You get a strategy, not a chart

What to suppress. What to re-permission. Which segment becomes your default target. What to stop reporting. What to send next. Decisions with the measurement sitting right behind them, which is the whole difference between a dashboard that looks busy and a list that produces revenue.

Recommendations you can defend

Here is the whole category claim. Plenty of tools will happily show you an open rate. If a tool cannot tell you the IP, the network and the device behind that open, it is not measuring engagement. It is reporting a number and quietly hoping you never ask where the number came from. ListRefiner was built to be asked.

Why agencies and founders choose us

Stop optimizing for an audience that isn't there.

Here is the part that surprised us. In the audit above, once a real person clicked, every platform converted them at the same rate. Nothing was wrong with the message. The entire difference came down to knowing who to send it to, and that is a forensic question, not a creative one.

01 / Reach

Mail the people who exist

A verified segment out-performed the raw subscriber base nineteen to one per address. Smaller sends. Same revenue. A fraction of the volume. And a sending reputation that survives the year.

02 / Truth

Two numbers, never one

Click rate, human-filtered, tells you how the campaign performed. Machine share tells you how healthy the list is. Blend those two together and a dying list can look busy for years.

03 / Retention

Keep the subscribers you never lost

Link scanners follow every URL in a message, and that includes the unsubscribe. Without a confirmation step, a security appliance can opt out a customer who never asked to leave. We show you the moment it happens.

04 / Migration

Change platforms without losing momentum

Warm the new sending domain on proven-human addresses first, then widen out. You arrive at the new ESP with a list you can vouch for instead of one you inherited and hoped about.

05 / Attribution

Follow the click all the way to the sale

Per-recipient codes trace a purchase back to the exact message, link and device that produced it. In that audit, eleven of the thirteen buyers bought within eight minutes of clicking.

06 / Deliverable

A report you can bill for

You receive the classified CSV and the AI-assisted write-up built from it. Findings, suppression lists and recommendations in language a client reads without translation. Audit it yourself, put your name on it, take it anywhere.

Next step

Find out what is actually on your list.

Here is how easy this is. Open a free account. Upload a sample list. Our 32-page report is waiting for you inside the members' area, and it hands you the classification method, the suppression rules, and how to read a send log line by line. It costs you nothing. It takes a few minutes. And you will know something about your list tonight that you did not know this morning.

Free account · No credit card · Bring a sample list