Add to Chrome - free or get Pro
If your cold email dashboard reports 50-70% opens, there is a decent chance a third of those "opens" never involved a person. Not because the tool is lying, but because three different machines fetch tracking pixels on behalf of your recipient.
Since iOS 15, Apple Mail pre-fetches remote images for users who enable MPP, regardless of whether the message is ever read. The fetch comes from Apple's proxy infrastructure, so the request looks like a normal image load with a plausible user agent.
Gmail rewrites image URLs through googleusercontent.com and fetches them itself. Two
tells, both reliable:
Chrome/42.0.2311.135 … Edge/12.246 — a browser combination that has not existed in
years. It does not include the string GoogleImageProxy, which is why user-agent
classifiers that only look for that token miscount it.66.249.,
66.102., 64.233., 209.85. and similar Google blocks, not from
the recipient's ISP.Microsoft 365 with Defender, Barracuda, Mimecast, Proofpoint and friends detonate or rewrite every URL in an inbound message, images included. A scanner in Frankfurt "opens" your email before the recipient's laptop is even awake.
Export the raw events from your sending tool — not the summary, the per-event log with IP and user agent. Then run these four checks:
| Check | What a machine hit looks like |
|---|---|
| Repeated hits from one IP | Same IP loading the pixel 4-10 times within a minute, often within seconds of delivery. |
| User agent | Datacenter-ish strings, the frozen Chrome 42 / Edge 12 pattern, or
python-requests-style clients from link scanners. |
| Timing | Human opens cluster in working hours and spread across days; machine fetches land in a tight band right after send. |
| IP ownership | Look up the ASN: Google, Apple, Microsoft, or a security vendor instead of a residential ISP. |
When we applied exactly this to our own sends, the dashboard said 61% opens and the human-only number was 34%. The click rate barely moved between the two definitions — which tells you which metric was real all along.
How OutReach Pilot handles it: every hit is classified as human, proxy prefetch or bot scan. Proxy and bot events are stored with their IP and user agent but never counted as opens. You can see the panel or read how this differs from a classic read-receipt tool.
Honest tracking makes your numbers look worse than the competition's. If a vendor shows 60% opens on the same list where you measure 34%, the vendor is not better at email — it is counting prefetches. Any tool that cannot separate machine traffic from a human open is reporting activity, not attention.
Written by the maker of OutReach Pilot. The classifier described here is in the product, and the fingerprint table is what we actually use.
Two or three emails a year. One-click unsubscribe that works.