Check new HubSpot leads for spam and malicious domains

When HubSpot sends a contact creation webhook for a new inbound form fill, screen the contact for spam and fraud before a salesperson wastes time on it.

Take the contact ID from the webhook payload and read the record with HubSpot Search Contacts, pulling at least the email address, the first and last name, and the company website property. If the record is not returned on the first attempt, wait a few seconds and try once more, since the webhook can arrive marginally before the record is queryable.

Derive up to two domains to check. Take the domain part of the email address, meaning everything after the @ sign. Take the domain of the website property, stripping the scheme, any www prefix, and any path or query string. Skip the email domain check for free consumer mailbox providers such as gmail.com, outlook.com, yahoo.com, hotmail.com and icloud.com, because a personal mailbox tells you nothing about the company behind the lead. If the email domain and the website domain are the same, look it up only once.

Look up each remaining domain in VirusTotal with Get a Domain Report. From each report read last_analysis_stats.malicious, last_analysis_stats.suspicious, and the reputation score under attributes.reputation.

This is the single most important rule in the whole workflow: absence of data is not a bad signal. A brand new but perfectly legitimate company domain will very often have no VirusTotal history at all, and a 404 NotFoundError simply means the domain is not yet in VirusTotal. Treat a 404, an empty report, or a thin report with zero detections as unknown, never as suspicious. Only ever flag on positive detections. Flagging on missing or thin data will quietly suppress good leads, which costs far more revenue than letting a little spam through.

Judge the lead as exactly one of three verdicts. Legitimate when no engine reports either domain as malicious or suspicious, and this explicitly includes the case where VirusTotal holds no data on the domain at all. Low quality when there are only weak signals, for example a small number of suspicious detections with no malicious ones, or a clearly negative reputation score without malicious detections. Malicious when one or more engines report either domain as malicious.

Write the verdict back onto the record with HubSpot Update Contact into a lead safety property. Use a custom contact property such as lead_safety_status, and set it to the plain verdict value so it can be filtered on in lists and sequence enrolment criteria.

Attach the supporting evidence with HubSpot Create Note, associated to the contact, so the rep can see exactly why. The note should state which domains were checked, the malicious count, the suspicious count and the reputation score for each, and one plain sentence explaining the verdict. Where VirusTotal had no data on a domain, say so explicitly and state that this was not counted against the lead, so the rep reads it as unproven rather than risky.

Only when the verdict is malicious, send a message to the revenue operations channel with Slack Bot Send a Message. Include the contact name, the email address, which domain or domains triggered the verdict, the detection counts, and a link to the HubSpot record. The purpose of the alert is so somebody can suppress the contact before it enters an email sequence and damages the sending reputation of our domain. Do not post anything to Slack for legitimate or low quality leads, so the channel stays worth reading.

Be careful with rate limits and failures. The free VirusTotal tier allows four requests a minute, so pace the domain lookups rather than firing them together. If VirusTotal returns a rate limit error or a transient error, retry with a short backoff. If it still cannot be reached, write the verdict as unknown, note the lookup failure on the record, and do not alert Slack, because a failed lookup is not evidence of anything.