DigitalBlake

← All Articles

Bot Detection, Honeypots, and SMS Checks on Sales Leads

Posted: Updated: By Blake Cerecero

In a companion piece I laid out an idea for rating sales leads by identity. It checks three things:

  • the domain
  • the website
  • the person behind the email

Each one gets a score, and the real leads rank above the bots. You also need to compare identity against the legitimacy of the submission.

A lead can show up with a real name and a real email, even one lifted straight off a company’s team page, and pass every identity check while only meaning to bog your sales team down. The checks confirm the data is real. They say nothing about whether the submission is genuine. After digging into each issue to come up with a fix I came away with the same results; every fix would increase the cost of an attack but never fully shut it down.

This is written for a technical reader, an engineer or developer, or a salesperson who does not mind a look under the hood. If you are on the sales side and some of the tooling below reads as deep in the weeds, that is fine. Skim it for the ideas and hand the parts you like to your own engineering team. This is a broad survey of what is possible. It is not a build guide. How any of it actually ships is a conversation between the sales and engineering teams, tuned to what you sell and who you sell to.

What you can do at the form, and why AI erodes it

Capture-side bot checks help, mostly against traditional bots

The standard toolkit still has value:

  • a honeypot field
  • form-fill timing
  • behavioral scoring like reCAPTCHA v3 or Cloudflare Turnstile
  • IP reputation and submission velocity

A well-built honeypot field catches simple bots at no cost to the user, and a time-based check that rejects submissions completed in under three seconds can catch many bots on its own (OpenReplay, WorkOS).

These capture-side checks assume the bot is in a hurry and behaves like a script. An AI agent can take its time, move a mouse on a natural-looking path, and spoof a browser fingerprint well enough to score as human, which is why people now describe behavioral CAPTCHA as losing ground (UNU, BroadChannel). These checks still catch the cheap, high-volume bots. A motivated adversary with AI gets past them.

A cleverer, AI-era honeypot

Instead of a math question any AI solves instantly, hide a field that asks a complex, unrelated natural-language question a human will never see. A bot parsing the page may answer it, and answering identifies it as a bot. Timing the submission helps too, since a person needs time to read and answer a question and an LLM agent answers almost instantly.

The hidden natural-language question works the same way as Palisade Research’s LLM Agent Honeypot from 2024, which combines prompt-injection traps with response-time analysis. That honeypot runs on SSH rather than a web form, and over about three months it collected 8,130,731 hacking attempts and 8 potential AI agents. Cloudflare’s AI Labyrinth runs the hidden-link version of the same idea at scale. A 2025 paper on LLMs polluting online research says the most advanced agent pipelines already include content filtering that stops the agent from filling in fields with suspicious styling attributes. The same paper recommends using prompt injections only as honeypot questions, because text that every participant can see could change how they answer. It raises the cost to the attacker without stopping them.

One trap to avoid: do not scatter hidden “stop” instructions across your visible page to keep AI out. Modern models read hidden text rather than skipping it (Auth0). They increasingly recognize an injected instruction as text to evaluate instead of an order to follow, and search engines read hidden-text-that-differs-from-what-users-see as classic black-hat cloaking and penalize it (Search Engine Land). Keep this to a single honeypot field on the form and keep it off your content pages.

Making the honeypot accessible also makes it easy for a bot to skip

A field that is only hidden visually is still announced to screen readers, which both hurts assistive-technology users and risks a false positive if one fills it. The accessible fix is to add aria-hidden="true" plus tabindex="-1" and autocomplete="off", with a realistic field name and off-screen CSS instead of display:none (FormShield, CSS-Tricks).

But those very attributes are the fingerprint a DOM-aware bot uses to recognize the honeypot and skip it. A modern bot emulates a real browser and reads the same accessibility and visibility semantics a screen reader does. Making the field correct for screen readers is what marks it for the agent. The timing check and varied, realistic field names still work. The hiding itself does almost none of the work.

Verification only proves control of an inbox or a number

Email verification falls to AI

The intuitive next move is to make the lead confirm they are who they say. Send a confirmation email, or a marketing email engineered to get them to click. A few years ago that was decent proof a human was on the other end. It stopped being true once there was infrastructure that gives an AI agent its own inbox specifically so it can receive that email, parse the link or code, and complete the flow on its own (AgentMail, OpenMail). Double opt-in was built to filter automation, and agents now complete it.

Phone and SMS are harder to fake, and they open a new attack surface

A phone number is harder to come by than an email, though not by much. Disposable and virtual numbers, “rented” tenured numbers, and SIM farms all exist, and commoditized OTP bots read the code out of the text and submit it for you (Authgear, Stytch). The low-friction way to use a phone number is passively: look up its line type and country and reject out-of-region or non-fixed VoIP numbers like Google Voice before you ever send anything, then make only the suspicious submissions do an actual code step so you do not hurt conversion on real buyers (Twilio Lookup).

Treat a passed code as a soft positive that the person controls a real, in-region number. Do not use it to reject leads outright. It adds friction, an AI can complete it, and it opens a new attack surface: SMS pumping, also called toll fraud, where bots feed your form premium-rate numbers they control and run up your messaging bill, with one cut going to them (Twilio). Elon Musk said in late 2022 that Twitter was losing around 60 million dollars a year to it, and he then ordered Twitter to cut off any telecom provider whose SMS traffic looked more than 10% fraudulent (Group-IB).

The one place the layers reinforce each other

Identity and verification are each easy to fool on their own. Stack them together and they get much harder to beat. Identity alone proves a matching real person appears to exist, but anyone can type that name and email. Verification on its own only proves the submitter controls some inbox or number, which could be a throwaway they own. The intersection is the hard part to fake: passing both means controlling the actual contact method of a real person whose public footprint, their LinkedIn, the company site, the role the domain implies, corroborates them. That is close to actually being them.

So gate it. Use the identity score from the companion piece as the trigger, and only spend a verification step on leads that already clear the identity threshold. You get two things for that. A verification pass is only meaningful once identity says the person looks real and corroborated. And gating the send closes off the SMS-pumping problem from the last section, because a bot spraying premium-rate numbers never reaches the send, since it never clears identity.

None of this is a new invention, to be clear. It is risk-based orchestration, where cases run through different verification layers depending on risk, plus the cross-reference-everything logic that fraud and KYC teams have used for years to catch synthetic identities. Prove sells a version of it, with a step-up-capable authentication layer that leans less on SMS one-time passcodes. The only fresh part is pointing it at sales-lead scoring and using the identity score itself as the gate.

It does nothing for the legitimate buyer using a personal email, who has no corporate footprint to match against. And a determined actor who genuinely controls a matching person’s inbox, including that real person deciding to waste your time, still passes. It is the strongest single signal you can assemble. It will still let some bad leads through.

The leading edge

Detection itself got much better. Device intelligence at billion-device scale now includes explicit authorized-AI-agent detection, and behavioral biometrics measure typing cadence, swipe pressure, and device grip angle to build a baseline for each customer. Paired with persistent device fingerprinting, these catch coordinated abuse, such as one fingerprint showing up across several customer accounts in a single day. They are still guessing from behavior, which is the approach the rest of this article says you slowly lose.

The real shift is to stop guessing and ask for a signature. Web Bot Auth, an IETF draft built on signed HTTP requests, has an agent prove its identity with a published cryptographic key instead of leaving you to infer it, so a site can allow, rate-limit, or deny per identity rather than per guess. It is already backed by Cloudflare, Akamai, Amazon’s agent browser, and Google, which signs a subset of its Google-Agent requests this way and calls its own implementation experimental. Running alongside it, “know your agent” work binds an agent back to an accountable, verified human. The question changes from “human or bot?” to “which verified human is this agent acting for, and is it allowed to do this?”

This is mostly draft and preview in mid-2026, and it does nothing for an anonymous spammer who simply will not present a signature on your public lead form. But it is the first approach that stops depending on out-detecting an adversary who keeps getting better. Verifiable identity is the way out of this arms race, if there is one.

The arms race as a scoring pipeline

No single layer blocks a determined adversary. Stack them and each one contributes a signal, and those signals roll up into one number the sales team can sort by, the same way the identity checks did in the companion piece. Nothing here hard-rejects except the obvious traditional bots. A determined human or AI still gets a number, just a low one, while a real buyer scores near the top.

The score shows up as a sortable, filterable column right inside the CRM, whether that is Salesforce or HubSpot, so the sales team still sees the low scorers alongside everything else. A rep who wants to open a low-scored lead and chase a big deal anyway can do that. The score sorts the leads and does not make decisions for the rep.

The lead legitimacy arms race as a scoring pipeline Flow diagram. A form submission with name, email, and maybe phone passes through stacked layers. Layer 1, capture-side bot checks (honeypot, fill timing, reCAPTCHA v3, IP velocity), produces a traditional-bot score. Layer 2, a prompt-injection honeypot with a hidden question only a page parser would answer, produces an AI-bot signal. Layer 3, identity checks (domain age, website match, person footprint), produces an identity score from 0 to 10. A gate then asks whether the identity score is above the threshold. If no, verification is skipped and there is no SMS-pump exposure. If yes, Layer 4 runs verification (gated email or SMS with line-type and region filtering) and produces a control signal, and identity times control forms the keystone. Both branches merge, durable signals over time (post-submission engagement, domain history) are added, and everything rolls up into a Legitimacy score from 0 to 10, a dial the sales team sorts by, working the highest scores first. Form submission name, email, maybe phone Layer 1 Capture-side bot checks traditional-bot score honeypot, fill timing, reCAPTCHA v3, IP velocity Layer 2 Prompt-injection honeypot AI-bot signal a hidden question only a page parser would answer Layer 3 Identity checks identity score 0 to 10 domain age, website match, person footprint Is the identity score above the threshold? no yes Skip verification no SMS-pump exposure Layer 4 Verification gated email / SMS line-type + region filter control signal identity × control = keystone + durable signals over time post-submission engagement, domain history Legitimacy score: 0 to 10 a dial sales sorts by Sales team works the highest scores first

Spending the verification step only on leads that already clear the identity threshold is what keeps the SMS-pumping attack surface closed and keeps friction off real buyers. Everything else just nudges the score up or down.

Where that leaves us

Identity checks give you signals you can score and act on. Legitimacy is an arms race that never fully resolves. Anything you can verify at the exact moment of submission can be faked or auto-completed by an adversary with AI, and the more I dug, the more every check turned into a cost the determined ones simply pay.

The signals that hold up are the ones that are expensive to fake at scale:

  • Matching the email to an aged, reputable company domain, because spinning up a website takes an afternoon and building a credible history takes years.
  • Genuine engagement after the fact: real opens, return visits, an actual reply and a conversation.
  • Human judgment on the leads that sit on the line.

None of those are instant, which is why they are harder to spoof.

Tune those signals to who you actually sell to. Domain age and a corporate email work in your favor when your buyers are mature companies. Point them at startups and they backfire, because a real early-stage buyer has a young domain and often a personal email, the same profile most spam has. If startups are your market, ease off the age penalty and pull in a different check instead: look the company up in funding databases to see whether it exists, what round it is in, and whether it has the budget to buy what you sell. That last point cuts both ways, since a company that new may not be ready to invest in your product yet. There is no single right setting here, only the one that matches your target market.

So rank your real leads with the identity checks, keep the traditional-bot defenses on for what they do catch, and accept that proving good-faith intent is something you manage over time. If you want the upstream half of this, scoring and ranking the leads that are real, that is the companion article.

If you are on the sales side and have questions about how any of this would actually work for you, I answered a batch of them in a follow-up: answering questions asked by a salesperson on lead scoring.

References

Bot detection, honeypots, and CAPTCHA decay:

Prompt-injection honeypots and hidden-prompt cloaking:

Email verification defeated by agents:

Phone and SMS verification, line-type filtering, and SMS pumping:

Risk-based verification and the leading edge:

Looking for a senior developer? I'm open to new opportunities (opens in a new tab) or send an email .

Related Posts