How to tell real contact form leads from AI spam and sales pitches

Contact form spam used to be easy to spot: gibberish, crypto links, the same message pasted on every site. A lot of it now reads like a real person wrote it for you. It names your business, mentions a service from your website, and asks for a quick call. CAPTCHAs still stop the cheapest bots, but they were never built to answer the question you actually care about: does this person want to buy from you, or sell to you?

This guide covers why that shift happened, a five-check screen you can run on any form notification, three worked examples, and changes to your form that cut pitches without turning away real customers.

Why CAPTCHAs stopped being enough

The clearest public example is AkiraBot, documented by SentinelOne's SentinelLABS researchers in April 2025. The tool scraped each target website, then used OpenAI's chat API (the gpt-4o-mini model) to write a custom message promoting an SEO service, so every message described the site it landed on. It went after sites built on Shopify, GoDaddy, Wix and Squarespace, plus generic contact forms and live chat widgets, and it used CAPTCHA-solving services and browser fingerprint tricks to get around reCAPTCHA and hCaptcha. The researchers counted more than 80,000 websites successfully spammed and over 420,000 targeted since September 2024. OpenAI disabled the API key involved after the report.

The report's own takeaway is the useful part: because the text is different every time, filters that look for a repeated message fail. Plenty of pitches are also typed by real people in real browsers, which no bot check is meant to stop. Something has to read the message itself.

A five-check screen for each form notification

Open the notification and read the message field, not just the sender. Run these checks in order.

1. Is the person asking about something you sell? A real inquiry usually names a problem, a service, a date, a place or a budget. "Can you fix a leaking faucet near Cedar Street this week?" is a lead. "We help businesses like yours rank on the first page of Google" is not about your services at all.

2. Does the sender introduce their own company or offer? Pitches lead with who they are: "we are a growth agency," "our team specializes in." Customers talk about their own situation first.

3. Is the ask a free audit, a demo or "a quick call" with no job attached? A customer might want a call too, but it comes after a description of what they need. A call request with nothing behind it is outbound sales.

4. Is there a link that sends you somewhere? Booking pages, portfolios and sample reports are common in pitches. Most customers have no reason to send you a link, though some paste their own website, so treat a link as a hint, not proof.

5. Have you seen this shape before? Same flattery, same offer, different name. Pitches arrive in waves, so a message that mirrors one from last week is probably part of a campaign.

One strong pitch signal is enough to put a message in a "later" pile. When the message is too thin to judge, and the contact details look real, keep it for a reply. A slow answer to a real customer costs you less than archiving them by mistake.

Three examples

Every business, person and domain below is made up. The examples are written for a fictional plumbing business, Cedar Lane Plumbing.

A real inquiry

Name: Mira Kell
Email: mira.kell@mail.example
Message: Our kitchen sink backs up every
morning. Are you available this week for
a drain clearing in Oakridge? We're home
after 4pm.

A problem, a place and a time window, with no company introduced. Reply to this one first.

An AI-written SEO pitch

Name: Growth Desk
Email: hello@growthdesk.example
Message: Hi Cedar Lane Plumbing team, I
came across your website and loved your
drain clearing page. We specialize in
local SEO and can help you rank for
plumber searches in your city. Free
audit this week?

Clean grammar and a real detail from your site, but it fails checks 1, 2 and 3. A page-specific compliment is exactly what tools like AkiraBot generate.

A vendor pitch

Name: LeadList Co
Email: partners@leadlist.example
Message: We have exclusive homeowner
lead lists for plumbers in your ZIP
codes. Book a 15-minute call to see
sample data:
https://book.leadlist.example

They're selling something to you, they want a call and they've included a booking link. That's a vendor pitch.

Changes to your form that cut pitches

These reduce volume at the source. None of them stops everything, so pair them with the screen above.

Add a short notice right next to the form, not in the footer. Something like: "This form is for customer inquiries. Sales and marketing offers won't receive a reply."
Add a required "Reason for contact" dropdown with options such as "I need a quote," "I'm an existing customer" and "I'm offering a product or service." Many form builders can send each answer to a different address. WPForms, for example, calls this conditional notifications. Send the "offering a service" answers somewhere you check once a week.
Be careful with keyword blocklists. Blocking "SEO" or "marketing" also blocks a customer who mentions either word, and AI-written pitches change their wording every time. If you use one, keep it to phrases no customer would write, like "guest post" or "backlinks," and review matches instead of deleting them.
Keep your bot protection. Honeypot fields and CAPTCHAs still stop the low-effort scripts, which leaves fewer messages for you to read.

What not to do

Don't auto-delete form notifications. A real customer will trip a filter eventually, and you want a record of every submission.
Don't auto-reply to every submitter. An instant "thanks for your inquiry" tells a pitch list your inbox is read.
Don't reply to argue with pitches. Archive them. A reply invites a follow-up sequence.

Sorting the notifications you already get

If you get more than a few form emails a day, the screen above becomes a chore. Creating Gmail labels such as Real, SEO pitch, Vendor and Unclear and applying one to each notification helps you see the pattern, and Gmail filters can match a sender, a subject or set words. What they can't do is judge intent, which is the whole problem here.

That's the part we built an n8n template for. Form Lead Filter watches the form-notification emails already arriving in your Gmail, so nothing on your website changes. It labels each one as a Real Inquiry, SEO Pitch, Vendor Pitch, Job Seeker, Bot or Spam, or Unclear, with a short reason, and saves a reply draft for real inquiries. It doesn't delete anything, and every draft waits in Gmail for you to review and send yourself. It runs on your own n8n with your own OpenAI API key, which adds a small per-email cost billed by OpenAI. It's also on itch.io.

Sources

Gmail is a trademark of Google LLC. n8n is a trademark of n8n GmbH. Other product names belong to their owners. ReadyUpAgents is independent and not affiliated with or endorsed by n8n, Google or OpenAI.