We're receiving a steady stream of form submissions that pass our reCAPTCHA and look legitimate at first glance. The messages usually ask for a product catalog or pricing information and use polished business language, but the email domains are often slightly different from those of real companies. We only discover they're fake after contacting the supposedly interested businesses. The submissions come from many different sources, so we haven't identified a single origin. What practical measures can we use to reduce or block this kind of spam?
2 Answers
Check and log the submitting IP addresses, then look for geographic or hosting-provider patterns. Add a honeypot field that is hidden from normal visitors but must remain empty; automated form bots often fill it in, and this can remove the vast majority of basic spam. You can also score or block messages containing common wording such as “revert” or “needful” if those phrases aren't relevant to your customers. Catalog requests submitted through a general contact form are often a strong spam signal as well.
The honeypot made the biggest difference for us. It eliminated roughly 99% of the automated submissions, even before adding more aggressive filters.
A bot-mitigation service such as Cloudflare may help by filtering suspicious traffic before it reaches your form, although it won't necessarily eliminate every submission. Some sites still receive a few of these messages each day even with paid protection, so it works best alongside form-level filtering.
We already have a honeypot field, but we haven't reviewed the IP data yet. We'll start checking those addresses and patterns.