Filtering spam inquiries: detection rules, blacklist library, and manual review
1. Where spam inquiries come from: four sources and how hard they are to spot
With your form open, any kind of traffic can come in. Spam inquiries don’t appear at random; they come from four steady sources, each with a completely different detection difficulty and handling cost. Identify the source first, then decide which layer of rules should block it.
| Source type | Typical signs | Typical share | Detection difficulty | Recommended filter layer |
|---|---|---|---|---|
| Automated bot submissions | Fields filled in randomly, email on a disposable domain, IP in a known proxy range | About 25% to 35% | Low, rules can cover it | L1 hard block |
| Competitor snooping | Company name spelled correctly, very detailed questions, email on a corporate domain | About 5% to 10% | High, needs human judgment | L3 manual review |
| Irrelevant inquiries | Not about your product, but about job hunting, partnerships, or ad space | About 10% to 15% | Medium, keywords can pre-screen | L2 rule scoring |
| Low-quality real inquiries | Real email, vague needs, no quantity and no destination country | About 15% to 20% | Low, but you can’t block them | L4 into the nurture queue |
The percentages above are the typical range for B2B independent sites and vary widely by industry. Automated bot submissions are the easiest to block because their behavioral fingerprint is stable: submission time under 2 seconds, all fields completed in a single request, email domain from a 10-minute or temporary email service. Send these straight to L1 hard blocking; no one needs to look at them.
The real headache is competitor snooping, because it looks so much like a real inquiry. The company name is spelled properly, the questions are professional, and the email domain is normal. Rules can’t block these; you need L3 manual review. This is also why filtering can’t be fully automated: the harder you block, the better competitors disguise themselves, and the higher the risk of wrongly rejecting real customers. For the form’s own anti-spam capabilities, see Inquiry Form Reliability and Spam-Proof Delivery.
2. The four filtering layers: what each one does and doesn’t do
Filtering runs in four layers. The point is to separate what is definitely spam from what might be real. Definite spam gets dropped, maybe-real goes to a human, and the middle ground is sorted by rule-based scoring. Each layer does only its own job; skip a layer and you start killing real leads.
| Tier | Action | Basis for determination | Cost of false positives | Turnaround |
|---|---|---|---|---|
| L1 Hard block | Dropped outright, never reaches CRM | Known spam domains, proxy IP ranges, disposable email addresses | Almost zero | Real time, milliseconds |
| L2 Rule scoring | Low scores go to spam, high scores flow through | Field completeness, keywords, submission time, email domain reputation | Low, needs monitoring | Real time, milliseconds |
| L3 Manual review | Judged spam or real inquiry within 30 minutes | Suspicious score range of 50 to 70, edge cases | Medium, depends on human judgment | Within 30 minutes |
| L4 Normal flow | Enters the sales queue and is followed up per SLA | Score above 70, complete fields, normal behavior | zero | Per first-response SLA |
The score thresholds are the heart of this table. Below 50 goes straight to spam, 50 to 70 goes to the manual review queue, above 70 flows through normally. These cutoffs are not guesswork. They come from backtesting your own inquiry history over the past three months: label the known closed deals and the known spam, run the scoring model, and find the point where the split is most accurate. Recalibrate the thresholds with new data every quarter.
A concrete example: an inquiry comes in with a gmail.com address, the company name field says “Trading Co”, the requirements field says “need price list”, and it was submitted at 3 a.m. Under the L2 rules, the fields are incomplete, the company name is too generic, and the email is a free provider, so it scores about 55 and goes to L3 manual review. A sales rep takes one look, sees the IP is in Hong Kong and the email was registered less than 30 days ago, and marks it as a low-quality lead. It goes into the nurture queue rather than being discarded. That is the value of layering: no false accusations, and no free pass either.
3. Blacklist database: three layers, maintained on a rolling basis
The blacklist is not a static list. It is a living database with three layers. The static list is the smallest part; what actually does the work is the ongoing maintenance of the cumulative layer and the whitelist layer.
| Tier | Content | Update frequency | Maintenance approach | Typical share |
|---|---|---|---|---|
| Automatic layer | Known spam email domains, proxy IP ranges, disposable email services | Sync third-party lists weekly | Pulled automatically, no manual work | About 60% |
| Cumulative layer | Suspicious emails, IPs, and company names flagged by hand | Appended daily, re-evaluated monthly | Sales flags feed in automatically | About 30% |
| Whitelist layer | Known real customers, partners, and contacts from trade show cards | Updated as deals and leads change | Added after manual confirmation | About 10% |
The whitelist layer is the easiest to overlook, but it is the key to preventing false positives. Say a customer picks up your card at a trade show and later requests a quote through your website form. His email might be a free provider and his company name might be filled in very briefly, so rule-based scoring could send him to L3. But if he is on the whitelist, he goes straight to L4 and skips every filter. This mechanism lets you set stricter rules, because you know real customers will not get stuck.
The rolling window for the accumulation layer is 30 days. When an email is manually flagged as suspicious, it enters the accumulation layer. If it submits again within 30 days and behaves normally that time, it is removed from the accumulation layer. Don’t permanently block — some people really are reaching out for the first time, or they’ve switched emails to get back in touch. Only use a permanent blacklist when you’ve confirmed malicious scraping or a competitor repeatedly probing you. For the overall approach to lead scoring and prioritization, see Lead Scoring and Prioritization for Inquiries.
4. Manual review: when a human has to step in
More manual review isn’t better. If your review volume exceeds 15% of total inquiries, your L2 rules aren’t tuned well — you’re pushing too many cases that could have been decided automatically to a human. Keep the review rate between 10% and 15%. More wastes manpower; less means your rules are too coarse and your false-positive rate is climbing.
| Scenario | Score range | What to do | Decision window | Error handling |
|---|---|---|---|---|
| Obvious spam | Under 40 points | Auto-discard | Real-time | Audit 5% monthly to catch false positives |
| Suspected suspicious | 40 to 60 points | Enter manual review queue | Within 30 minutes | Appeal within 24 hours of decision |
| Borderline case | 60 to 70 points | Manual review + sales confirmation | Within 1 hour | Default to treating as a real inquiry |
| Clear real inquiry | Above 70 points | Go straight to the sales queue | Per first-response SLA | Sales can send back for review if misjudged |
The default action for borderline cases matters: in the 60 to 70 point range, default to treating it as a real inquiry, not to discarding it as spam. The reason is simple — the cost of killing a real inquiry is far greater than spending 30 extra minutes on a low-quality lead. This default direction is the single most important switch in a filtering system. It decides whether your overall bias is “rather let it through” or “rather kill it by mistake.”
Example: an inquiry comes from Germany, the email is on a company domain, the company name is “Müller GmbH,” and the request reads “interested in your product, please send catalog.” The fields aren’t complete, but the domain is normal and the region is normal. It scores 65 points and enters the borderline case queue. The salesperson on duty takes a look and finds in the site visit records that this visitor viewed 6 product pages and stayed 12 minutes — judged a real inquiry, routed normally. This is the value of manual review plus behavioral data: form fields alone aren’t enough; you need to see what this visitor did on your site. For how to connect visitor behavior with form fields, see Inquiry Form Field Design and Conversion Rate.
5. Counterintuitive: the stricter the filter, the quieter sales gets — but lost deals don’t set off alarms
Most people assume the goal of filtering spam inquiries is “block as cleanly as possible.” That’s wrong. The real goal of a filtering system isn’t the block rate — it’s the false-positive rate. A system with a 90% block rate that kills 3% of real inquiries isn’t filtering out spam; it’s filtering out your business.
| Metrics | Healthy range | Warning line | Danger line | Action |
|---|---|---|---|---|
| Block rate | 45% to 60% | Above 70% | Above 80% | Check whether rules are too strict |
| False-positive rate | Under 2% | 2% to 5% | Above 5% | Immediately widen the borderline range |
| Manual review rate | 10% to 15% | 15% to 25% | Above 25% | Optimize L2 rules to cut review volume |
| Spam slip-through rate | Under 5% | 5% to 10% | Above 10% | Add to the blacklist and keyword list |
The number that matters most in this table is the false-positive rate. How do you measure it? Every month, pull a random 5% of the inquiries discarded at L1 and L2 and review them by hand. If any of them turn out to be real inquiries, your rules are too strict. You can’t skip this sampling step. A filtered-out inquiry will never come back and tell you “I was actually real” — you have to go check yourself.
Another thing people overlook: spam inquiries change shape. A keyword rule from three months ago may now be blocking inquiries from legitimate buyers. So the blacklist and scoring rules have to be backtested against fresh data every quarter, not set once and forgotten. Connecting your website data to your CRM is what makes the whole filtering system run at all; see Website leads to CRM.
FAQ
How strict should spam filtering rules be?
How do you spot disposable email addresses?
How do you tell a competitor snooping around from a real customer?
How do you build a whitelist that actually works?
How often should filtering rules be adjusted?
If a form is submitted in under 2 seconds, is it definitely a bot?
Final thoughts
The biggest mistake in spam inquiry filtering isn’t too few rules — it’s rules that are too harsh. Many teams start by adding CAPTCHAs, phone verification, and company domain verification to their forms. The spam drops, but so do half the real inquiries. A filtering system should be designed to “protect real customers from false positives,” not to “keep everything suspicious out.”
Three steps to implement: first, get L1 hard blocking running, using existing third-party spam lists to cover bot submissions; then build L2 rule scoring and backtest thresholds against historical data; finally, set up L3 manual review, keeping the review rate at 10% to 15% and spot-checking the false-positive rate monthly. Once these three layers run smoothly, you have a filtering system you can monitor and tune — not just a wall that blocks people.
One line worth remembering: the goal of filtering spam inquiries isn’t how cleanly you block, but how low you keep false positives — the cost of falsely rejecting one real inquiry is ten times the cost of letting ten spam inquiries through.