Bot Finder FAQ

What is Bot Finder?

Bot Finder is InboxEagle’s email fraud intelligence feature that classifies email opens and clicks as bot, suspicious, or human. It processes events from Amazon SES (via an SNS/SQS pipeline), Mailgun (via webhooks), and Klaviyo (via webhooks), then delivers bot-filtered engagement signals to your InboxEagle dashboard.

---

Why do I have so many bot opens?

Bot opens are normal and expected in modern email. The most common sources:

• Apple Mail Privacy Protection (MPP) — Apple pre-loads email images (including tracking pixels) on behalf of users, inflating open rates by 20–40% for Apple Mail audiences.
• Gmail Image Proxy — Gmail caches images through a Google proxy when recipients view emails in Gmail, which may register as an open even before a human reads the email.
• Corporate security gateways — Tools like Proofpoint, Mimecast, Barracuda, and Microsoft Defender scan email links to detect phishing and malware, generating click events without human intent.

Note

A bot open rate of 10–30% is typical. Consistently above 40% suggests additional factors — often stale list segments or lists acquired through co-registration. Use Bot Finder’s suppression recommendations to clean your list.

---

What is the difference between “bot”, “suspicious”, and “human”?

Bot Finder assigns a confidence score from 0 to 100 to every event:

Classification	Score range	Meaning
Human	0–24	Very low bot probability; treat as real engagement
Suspicious	25–39	Moderate signals; could be a privacy proxy or security scanner
Bot	40–100	High confidence; exclude from engagement metrics

The score is computed by a 6-layer pipeline combining timing analysis, IP intelligence, user agent checks, cross-tenant reputation, and per-recipient history.

---

Is Apple MPP a bot?

Apple Mail Privacy Protection is not a traditional “bot” — it is a privacy feature Apple built into iOS 15+ and macOS Monterey that loads email images (including tracking pixels) before a human opens the email. From a deliverability perspective, these pre-loaded opens are not meaningful engagement signals.

Bot Finder classifies MPP events as suspicious (not full bot) by default, because there is often a real human who eventually reads the email. The suspicious classification ensures MPP events are flagged but not removed from your metrics with the same confidence as clear bot events.

Tip

If you want MPP classified as bot rather than suspicious, raise the bot threshold to 35 in the advanced configuration.

---

I think Bot Finder is incorrectly classifying a real subscriber. What do I do?

Submit a false positive correction from the Recent detections table:

1. Open the Bot Finder dashboard
2. Find the event in the Recent detections table
3. Click the event row
4. Select Mark as human (false positive)

Bot Finder uses this feedback to adjust future scoring for that recipient. After enough feedback, the recipient’s events will be classified as human even if timing or IP rules fire.

---

What does “cross-tenant reputation” mean?

Bot Finder aggregates bot signals across all InboxEagle tenants (anonymized). If a specific IP address or ASN consistently generates bot events across multiple accounts, that shared reputation data boosts the bot score for events from that IP — even if the individual event does not show other red flags.

This layer is particularly effective at catching new bot IPs that are not yet on public blacklists.

---

Why does Bot Finder sometimes miss bots that I can clearly see in my ESP?

Bot Finder relies on events delivered via SES, Mailgun, or Klaviyo webhooks. If:

• Events are delayed (SQS delivery lag, webhook backpressure)
• The event source is not one of the three supported providers
• The bot is using a legitimate consumer IP that has not been flagged

…the bot may not be caught.

Tip

For highest-confidence detection, add honeypot links to your email templates. Honeypot clicks are classified with a score of 90+ regardless of IP or timing signals.

---

How long does it take for events to appear in the dashboard?

After an email event occurs in SES, Mailgun, or Klaviyo, the sequence is:

1. Event delivered to InboxEagle (seconds for webhooks; up to 20 seconds for SQS long-polling)
2. Event analyzed by the bot detection pipeline (seconds to a few minutes depending on queue depth)
3. Event appears in the Bot Finder dashboard

Under normal conditions, events appear within 1–3 minutes. High-volume sends during peak hours may take up to 10 minutes.

---

Does Bot Finder work with providers other than SES, Mailgun, and Klaviyo?

Currently, Bot Finder supports:

• Amazon SES — Via SNS/SQS CloudFormation stack
• Mailgun — Via HMAC-signed webhooks
• Klaviyo — Via ECDSA-signed webhooks

Support for additional providers (SendGrid, SparkPost, Postmark) is on the roadmap. Contact InboxEagle support to express interest in a specific provider.

---

Does Bot Finder affect my email deliverability?

No. Bot Finder is a passive monitoring and analysis system. It reads events from your SES queue and webhooks but does not modify your email sending, suppress recipients, or change any data in your ESP. It only provides classified engagement signals for your review and analysis.

---

How do I disconnect Bot Finder?

To disconnect the AWS SES integration:

1. Go to Integrations → AWS SES in the InboxEagle app
2. Click Disconnect
3. Optionally, delete the CloudFormation stack from your AWS account to remove all created resources

To disconnect Mailgun or Klaviyo bot analysis:

1. Go to Integrations → [Provider]
2. Click Disconnect

Historical bot detection data is retained for 90 days after disconnection.