A field guide to contact-form spam
The thirty-odd genres of junk that arrive through a website form, from the obvious to the ones that fool people.
spamex sees a lot of contact forms. This is the list of what actually shows up in them, roughly ordered from easiest to hardest to catch.
The obvious
Link dumps and keyword stuffing. “casino bonus free spins loveshop biz 17 loveshop mirror”. Often Russian or Korean, often BBCode ([url=...]), often forty links long. Caught by URL count and vocabulary diversity before any model runs.
Pharma and adult. The classics. “Viagra 80 % off no prescription”, “I saw your profile, meet me tonight”. Learned spam phrases and the model handle these trivially.
Gibberish. Random names, random emails ([email protected]), a message of consonants. Identity heuristics: digit density, consonant runs, vowel ratio.
Giveaways, surveys, gift cards. “You have been selected for a $500 Amazon card”. Urgency plus a link.
The templated
SEO and backlinks. “I noticed your website is not ranking on page one”. The single most common genre on small-business sites. Personalised by machine with the site’s domain, which makes it look targeted.
“Your website has errors.” A free audit that finds the same 14 errors on every site.
Web design and redesign. “Your site looks outdated and is not mobile friendly.”
Guest posts and “partnerships”. “We run a network of DA50+ blogs.” Sometimes polite enough to pass as a real request; the giveaway is the offer arriving before any relationship exists.
Lead lists, followers, reviews. “500,000 verified decision-maker emails”, “10,000 real Instagram followers”, “50 five-star Google reviews, undetectable”.
Fake invoices and account alerts. “Invoice #48211 is 30 days overdue”, “unusual sign-in activity, verify within 24 hours”. Phishing wearing a business shirt.
Scare campaigns. GDPR fines, ADA lawsuits, “your site has been hacked”, copyright infringement notices with a link to “the evidence”.
The hard ones
The quick question. “Quick question, who handles marketing at your company? I helped a business like yours double revenue.” No link, no product name, plausible sender. This is where models earn their keep and where reputation across sites matters most: the same address sends the same quick question to hundreds of sites.
The disguised pitch. “Hi, I’m interested in your services. By the way, my company offers a free trial of our invoicing software at…” A real-looking inquiry with a payload in the second paragraph.
Job and freelancer spam. “Full stack developer with expertise in PHP, Laravel, React, Node, WordPress, Shopify, Python, AI, ML, blockchain. Please give me a chance.” Not malicious, still unwanted, and hard to separate from a genuine application without the site description.
Conference and award invitations where the speaker pays the fee. Domain brokers with an auction next week. Investment funds with 340 % returns.
The legitimate messages that look like spam
The mirror list matters as much, because these are the false positives waiting to happen: a real vendor sending a price list, a journalist with a deadline, a security researcher disclosing a bug, a job applicant with a portfolio link, an angry customer writing in capitals, a partnership proposal from a neighbouring business, a one-line “are you open on Sundays”.
spamex is built to recognise every one of those as legitimate, in several languages and styles. A filter that has not been taught to will flag them, and the site owner will never know.