Features Explained

SpamKill's foundational defense layer. Unlike CAPTCHAs, it works entirely behind the scenes — your visitors never see a challenge, checkbox, or puzzle.

When a form loads, SpamKill dynamically transforms it: field names are randomized each session, intelligent honeypot fields are injected with attractive names bots can't resist, and CSRF tokens are encrypted server-side. Then, real-time behavioral analysis kicks in:

• Mouse & pointer signals — movement patterns, velocity, acceleration, hover behavior
• Keyboard dynamics — typing speed, inter-keystroke timing, correction patterns
• Cognitive patterns — reading time, field navigation order, form completion strategy
• Device fingerprinting — hardware consistency, browser characteristics, automation framework detection
• Dual honeypot strategy — attractive field names ("email", "credit_card") plus pattern-matching decoys
• Server-side ML scoring — 8-category scoring pipeline using models trained on 100M+ submissions, processed in under 50ms

The result: bots are blocked instantly while real humans submit forms without knowing protection exists.

Detects submissions from temporary email services like Guerrilla Mail, 10MinuteMail, Mailinator, and hundreds of others. These throwaway addresses are commonly used by spammers, fraudsters, and bots to bypass email verification.

You choose what happens when a disposable email is detected:

• Block — Reject the submission outright.
• Challenge — Present a verification step. If the user passes, the submission goes through.
• Ignore — Let it through (useful if you want to monitor without enforcing).

Controls how aggressively SpamKill filters submissions across your site. Set one level per site that matches your overall risk tolerance:

• Low — Only blocks high-confidence spam. Best when even one missed real submission would hurt (high-value sales pipelines, checkout flows, support requests).
• Medium — Balanced filtering. Catches most spam while keeping false positives rare. Recommended for most sites.
• High — Maximum protection. May occasionally flag edge-case legitimate submissions. Best when your site is under heavy bot attack (giveaways, public sign-ups, free trials).

Detects form submissions originating from known data center and cloud hosting providers — AWS, Azure, Google Cloud, DigitalOcean, OVH, and others. Real customers submit forms from residential or mobile IPs, not from servers.

Detection is based on ASN (Autonomous System Number) lookups, which identify the network owner behind every IP address. This catches automated scripts running on cloud infrastructure, even if they rotate IPs. You choose the action:

• Block — Reject submissions from data center IPs outright.
• Challenge — Present a verification step so legitimate users on VPS or corporate networks can still get through.
• Ignore — Detect but take no action (monitor only).

Lets you maintain your own list of blocked email domains. If you're consistently getting spam from specific domains (e.g. @spamdomain.com), add them to your blacklist and all future submissions from those domains are automatically rejected.

This is fully user-managed — you add and remove domains from your dashboard. Useful for blocking repeat offenders or known spam domains that are unique to your industry.

Another common use case: if you're a B2B business that doesn't accept leads from personal email addresses, you can blacklist free-mail providers (gmail.com, yahoo.com, hotmail.com, outlook.com) so consumer-style signups never reach your CRM in the first place.

Block form submissions from specific IP addresses or CIDR blocks. If you identify a particular IP or range that's sending spam, add it to your blacklist and all future submissions from that source are automatically rejected.

Supports both individual IPs (e.g. 203.0.113.50) and CIDR notation for IP ranges (e.g. 203.0.113.0/24). Fully user-managed from your dashboard — add and remove entries at any time.

Restrict form submissions by country using IP geolocation. Two targeting modes are available:

• Allow list — Only accept submissions from countries you specify. Ideal for businesses that only serve certain markets.
• Deny list — Target submissions from specific countries. Useful when you see concentrated spam from regions you don't operate in.

For each mode, you choose the enforcement action:

• Block — Reject submissions from targeted countries outright.
• Challenge — Present a verification step instead of blocking.
• Ignore — Detect but take no action (monitor only).

Filtering operates at the country level. When a submission comes in, SpamKill checks the IP's geolocation and applies your rules before the lead reaches your system.

A dedicated interface to review every submission SpamKill blocked. You see the full lead details — name, email, IP, country, submission data, and the exact reason it was blocked.

If you spot a false positive, you can mark it as such — SpamKill's models learn from your feedback — and copy the submitted lead details (name, email, message, etc.) into your CRM by hand. This gives you a safety net: protection runs on autopilot, but you always have the final say on edge cases.

Stream all form submissions to your own Datadog account for centralized monitoring and analytics. This is a read-only integration — you can view submission data, build dashboards, and set up alerts in Datadog, but you cannot flag or process submissions from there.

Setup requires a Datadog account (separate subscription). Once connected, every form submission — both allowed and blocked — is logged to your Datadog instance in real time with full metadata.

When SpamKill flags a submission as suspicious (but not definitively spam), it can present a verification challenge instead of blocking outright. This is not a CAPTCHA — it's identity verification tied to the specific submission. Three challenge types are available:

• WebAuthn Biometrics — Fingerprint, Face ID, or other device biometric verification.
• Social Login — Verify identity through a social provider (Google, etc.).
• Re-enter a field value — Ask the user to confirm a specific field from their submission.

You choose which challenge types to offer and SpamKill handles the rest. Legitimate users pass in seconds; bots can't.

Detects submissions routed through proxies or VPN services. You choose the action: block outright, challenge with a verification step, or ignore (monitor only).

• VPN detection — Identifies commercial VPN providers primarily by ASN lookup.
• Proxy detection — Covers data center proxies and residential proxies. Residential proxy detection accuracy may vary as these are designed to blend in with normal traffic.

This differs from "Block Data Center IPs" — data center blocking catches servers and cloud IPs broadly, while proxy/VPN detection specifically targets traffic-masking services, including residential proxies that don't originate from data centers.

Cross-references the name field against the email address to catch mismatches and gibberish entries. Two types of checks:

• Name-email mismatch — "Jake" submitting with [email protected] is flagged. Legitimate users almost always use an email that corresponds to their actual name.
• Gibberish detection — Entries like "asd", "test", "asdfgh", or random character strings are flagged. Real leads don't type gibberish into name fields.

You choose the action: block flagged submissions, challenge them with a verification step (giving real users a chance to prove themselves), or ignore (monitor only). This adds another signal layer on top of behavioral analysis — even if a bot passes other checks, mismatched or nonsensical name/email combinations are caught.

Every month, SpamKill automatically emails you an encrypted CSV containing all blocked lead data — full submission details including name, email, IP, country, timestamps, and block reasons.

The file is encrypted for security since it contains lead data. This gives you a complete audit trail without needing to log into the dashboard, useful for compliance, reporting, or bulk review of blocked submissions.

An enhanced version of Submission Logging that adds two-way feedback. In addition to streaming all submissions to Datadog, you can review every lead and mark it as:

• False positive — A genuine lead that was incorrectly blocked as spam. Marking it helps SpamKill learn and reduce future false positives.
• False negative — A spam submission that was incorrectly allowed through. Marking it tightens future detection for similar patterns.

This feedback loop directly improves SpamKill's accuracy for your specific traffic patterns over time. Ideal for high-volume operations where even small accuracy improvements have measurable business impact.

Protection never stops when you hit your monthly lead limit. SpamKill uses a fair, transparent overage model:

• First overage — You get a heads-up email. No charge. Grace period so you can decide whether to upgrade.
• Subsequent overages — Soft billing kicks in at per-block rates. You're charged in small increments, not for the entire next tier.
• Alerts — Notifications at 80%, 100%, and 150% of your monthly limit so you're never surprised.
• Smart recommendations — Your dashboard shows whether upgrading to the next plan would be cheaper than paying overage, so you always make the right call.

Overage rates vary by plan — from $5/100 leads on Starter to $10/10,000 leads on Elite. See the pricing page for the full rate table.