What Is a Spambot? Types, How They Work and How to Stop Them

A spambot is a program that sends or posts spam automatically: unwanted emails, form submissions, comments, sign-ups, and social media messages, in far greater numbers than a person could send by hand. Spambots find their targets by crawling the web for email addresses and for forms they can submit. To stop spambots, hide your email address from crawlers, add server-side checks to every form, and screen what still gets through before it reaches your inbox or CRM.

If you're dealing with spambots at volume, GoodInbound Lead Screen is a drop-in fix for the ones that fill in your forms. It screens how every visitor fills in your form and stops automated list bombing, spam, and non-buyers sending unsolicited pitches from cluttering your pipeline, with five layers of protection:

• Rules: domains you always accept or always block.
• Behavior: how the form was filled in: typing, pasting, fill time, automation tells, and a built-in honeypot.
• Network: data centers, VPNs, proxies, Tor, and bursts from one IP or device.
• Identity: whether the email has a working inbox and isn't disposable or gibberish, and whether the phone number is real.
• Message: the whole submission read for intent, so sales pitches, recruiters, and link offers are caught.

Every submission is classified into five types (lead, review, spam, junk, and bot), and only the real leads, based on your filters, are reported to your CRM and your ad platforms. GoodInbound takes care of the entire flow end to end for you.

Use GoodInbound for free for up to 500 screened submissions a month.

What is a spambot?

A spambot (also written "spam bot") is software built to deliver unwanted messages without a person typing each one. The first spambots were email programs. Today the same idea runs wherever text can be submitted: contact forms, newsletter sign-ups, comment sections, forums, review pages, direct messages, and chat apps.

Two jobs are usually split between different bots:

• Harvesters collect targets. They crawl web pages looking for email addresses, phone numbers, and forms.
• Senders deliver the spam. They send the emails, submit the forms, create the accounts, and post the comments.

A spambot isn't the same thing as a botnet. A botnet is a network of infected computers that an operator controls, and sending spam is one of the jobs it can be rented for. A spambot is the program doing the sending, whether it runs on a botnet, a rented server, or a laptop.

How do spambots work?

Most spambots follow the same four steps.

1. Find targets. The bot crawls sites the way a search engine does. It reads the page source, collects anything shaped like an email address, and notes every form and the URL that form submits to. Lists of addresses are also bought and traded.
2. Get access. Where a site needs an account to post, the bot registers one, usually with a disposable email address. Where it doesn't, the bot goes straight to the form.
3. Send. Simple bots never load the page. They post their text directly to the form's URL, thousands of times across thousands of sites. Better ones drive a real browser with no screen, fill in each field, and click submit like a visitor would.
4. Avoid being blocked. The bot rotates IP addresses through proxies, changes its wording, spaces out its attempts, and solves or pays to solve CAPTCHAs.

Newer spambots write their own messages. Instead of one template sent everywhere, they read the page they landed on and generate text that mentions your company and your industry. That defeats filters that look for repeated wording or a list of banned words.

Types of spambots

Email spambots

They harvest addresses from web pages, forums, and leaked lists, then send in bulk: advertising, phishing links, attachments carrying malware. Many forge the sender so the mail appears to come from a real company's domain.

Form spambots

They submit contact forms, quote requests, and demo forms. Some want to reach whoever reads the inbox with an SEO or web design offer. Some want a link published. Some are testing whether the form can be used to send email to other people. How to stop contact form spam covers the kinds you'll see.

Comment and forum spambots

They post in comment sections, forums, and review pages, usually to place links to another site or to push a product in front of readers.

Sign-up and list bombing bots

They create accounts and newsletter sign-ups in bulk. In a list bombing attack, a bot enters one victim's email address into thousands of sign-up forms so the victim's inbox floods with confirmation emails. Your form becomes part of an attack on someone else, and your sending reputation pays for it.

Social media and messaging spambots

They run fake accounts that follow, like, reply, and send direct messages in bulk, and they take over real accounts with stolen passwords to do the same from a trusted name.

What spambots are after

• Links and search rankings. Comments and profiles stuffed with links, in the hope that search engines count them.
• Phishing. Messages that lead to a fake login or payment page.
• Malware. Links and attachments that install something.
• Selling something. Bulk offers for SEO, web design, loans, pills, and anything else with a margin.
• Checking what works. Confirming which email addresses are live and which forms accept anything, so the list can be used again or sold.

What spambots cost a business

For most businesses the damage is quieter than malware, and it adds up.

• Buried real enquiries. A genuine lead sits unread between forty junk submissions.
• Wasted sales time. People chase leads that were never people. See spam leads.
• Wrong data. Fake sign-ups and submissions inflate conversion rates, and when a form fill counts as an ad conversion, they teach ad bidding to find more of the same.
• Email reputation. Sending confirmation emails to addresses a bot typed in leads to bounces and spam complaints, which hurts delivery of your real mail.
• Search penalties and warnings. Pages filled with spam links can be demoted, and sites hosting malicious links can be flagged by browsers.
• Server and service costs. Every fake request uses bandwidth, storage, and paid quota in whatever tools the form feeds.

Signs of spambot activity

• A sudden jump in submissions or sign-ups with no campaign behind it.
• Submissions at odd hours, or at a steady rhythm, such as one every few minutes all night.
• Forms completed within a second or two of the page loading.
• Identical or near-identical messages from different names and addresses.
• Links in fields that shouldn't have them, such as the name or company field.
• Random-letter names, disposable email domains, and phone numbers that don't exist.
• Many attempts from one IP address or one network range.
• Sign-ups that never open a confirmation email.

To check a suspicious submission, paste it into the free form spam checker, or put the address through the disposable email checker.

How to stop spambots

No single method stops every spambot, because simple bots and browser-driving bots fail different checks. Use several, and keep them on the server, where a bot can't skip them.

A few rules make these work better:

• Check on the server. Validation that only runs in the browser does nothing against a bot that never loads your page.
• Never trust the form's own fields for routing. A form that lets the submitter set the recipient or the email headers can be used to send spam to other people.
• Don't delete what you block. Label it and keep it, so a real enquiry caught by mistake can be recovered.
• Avoid making real visitors prove themselves. Every puzzle costs you some genuine enquiries. How to stop contact form spam without CAPTCHA covers the alternatives, and why reCAPTCHA is not stopping spam explains where CAPTCHAs fall short.

GoodInbound Lead Screen is the last row of that table. It runs on the form you already have with one script tag, or through hosted forms, a headless form backend, and a REST API. Each submission gets a label and a one-line reason, and anything that isn't a real lead stays out of your CRM, your notifications, and your ad conversions.

Protect your email address and your domain

Forms are one way in. The other two are the email address printed on your site and the domain your email is sent from.

Hide your address from harvesters. A plain mailto: link in your page source is the easiest thing on the page for a harvester to collect. Encode the address so people can still click it and simple harvesters can't read it. The free email obfuscator generates the code. A contact form with screening behind it is safer still.

Stop spambots sending as you. Spambots forge the sender on their mail, and nothing stops them using your domain unless you publish the records that say who may send for it. SPF lists the servers allowed to send your mail. DKIM signs each message. DMARC tells receiving servers what to do with mail that fails both, and you tighten its policy from monitoring only to rejecting forged mail once you've confirmed your own mail passes.

Are spambots illegal?

The software itself usually isn't, and what it is used for often is. In the United States, the CAN-SPAM Act sets rules for commercial email and treats harvesting addresses from websites as an aggravating factor. In Europe, privacy and electronic marketing rules require consent for most marketing messages. Spambots that spread malware, phish for passwords, or break into accounts fall under fraud and computer misuse laws.

Enforcement is the weak point. Operators hide behind proxies and work across borders, so for a site owner the practical answer is blocking and screening, not legal action.

FAQ

What does a spambot do?

It sends or posts unwanted messages automatically. Depending on its job, it harvests email addresses from web pages, sends bulk email, submits contact and sign-up forms, posts comments with links, or runs fake social media accounts.

How do spambots get my email address?

Mostly by crawling web pages and reading addresses out of the page source, including mailto: links. They also use leaked and traded lists, and some guess common addresses such as info@ and sales@ at any domain they find.

How do I stop a spam bot?

On a form, combine a honeypot field, a time check, and rate limits on the server, then screen submissions on behavior, network, and content so the bots that pass those are still caught. On your site, encode your email address. On your domain, set up SPF, DKIM, and DMARC so bots can't send mail as you.

Does CAPTCHA stop spambots?

It stops basic scripts. Bots that drive a real browser can pass invisible checks, and services solve challenges for a small fee. A CAPTCHA also does nothing about spam typed by a person, and it turns some real visitors away.

Are spam bots illegal?

Using them to send deceptive bulk email, harvest addresses, phish, or spread malware is illegal in many countries, under laws such as the CAN-SPAM Act in the United States. Prosecution is rare because operators are hard to identify and often abroad.

What is the difference between a spambot and a botnet?

A spambot is a program that sends spam. A botnet is a network of infected devices controlled by one operator. Botnets are often used to run spambots, because sending from thousands of ordinary computers is harder to block than sending from one server.

Why is my contact form suddenly getting spambot submissions?

Usually because a crawler found the form and added it to a list that many bots work from. Once a form accepts one automated submission, it tends to get more. It can also mean your form's submission URL is being posted to directly, without the page loading at all.

Should I block spambots or just ignore them?

Block them. Left alone, they bury real enquiries, distort your conversion data, and can hurt your email delivery and search visibility. Keep a record of what was blocked, with the reason, so mistakes can be undone.