If you were Google and wanted to find coordinated warmup pools in the Gmail firehose, you wouldn't need exotic ML. The signals are obvious once you know what to look for, and they borrow directly from techniques the Search team uses to find link farms and the YouTube team uses to find view-bot rings.
Warmup pools leak six fingerprint classes: graph closure, thread template uniformity, reply latency uniformity, diurnal mismatch, engagement co-occurrence, and domain age correlation. Each is detectable with simple classifiers. Stacked, they are nearly impossible to hide at pool scale.
1. Graph closure
Pool members mail each other at near-100% rate. Draw the directed graph of who-mails-whom over 30 days. Pool domains form a dense clique that almost never touches the rest of the internet. Real sender domains send to a long tail of recipient domains and receive from a different long tail.
Detection: compute the ratio of in-pool / out-of-pool mail per domain. Pool members sit at 0.6–0.9. Organic senders sit at 0.001–0.05.
2. Thread template uniformity
Warmup services generate threads from a template bank. Even with AI-rewriting, the structural skeleton repeats: subject patterns, greeting, one-paragraph body, sign-off. N-gram fingerprinting against the pool's own traffic lights up clusters of “fraternally similar” messages.
3. Reply latency uniformity
Humans reply to email on a log-normal distribution — a few fast replies, a long tail of hours-to-days. Bots in warmup pools reply on a tight Gaussian around whatever the tool's default is (usually 2–15 minutes). Fit a log-normal to the reply latencies of a domain's inbound engagement; a tight centred peak is a pool.
4. Diurnal mismatch
A US-based SaaS domain with even reply distribution across all 24 UTC hours isn't real. Real recipients cluster in their local business hours. Pools with members across timezones flatten the distribution; pools that hit every timezone hour uniformly are the distribution.
5. Engagement co-occurrence
“Mark as important”, “add to contacts”, and “move to inbox” are rare actions in organic mail — a few percent of messages. In warmup pools they're triggered on nearly every pool message because that's what generates reputation signal. The co-occurrence matrix of (domain A sent, domain B marked-important) is orders of magnitude denser within the pool than outside it.
6. Domain age and registrar correlation
Warmup pools skew toward new sending domains on cold-email stacks. Cluster domains by age, registrar, MX provider, and ASN. Real business domains scatter; pool members cluster tightly.
Why stacking them is lethal
A pool might defeat any one signal with enough effort. Defeating all six simultaneously at the scale of thousands of participating domains is a different order of problem. Each signal you scramble costs the vendor money; past some point it's cheaper to shut the pool down and tell customers to “focus on authentication”.
If you want the view Google has of your domain, the closest proxy you can get is an independent placement test from seed mailboxes outside any pool. Anything from within the pool grades itself.