Getting fake enquiries with 202-555 phone numbers? Here is why bots are targeting your website forms, what it costs your business, and the fixes that stop them.
Over the past year, we’ve been hearing the same question from more and more clients.
“Ever since we changed our website, moved hosting or launched a new version, all we’re getting is overseas spam enquiries. Has something gone wrong?”
In most cases, no. It isn’t your hosting, and it doesn’t mean your website has been hacked.
Right now there’s a specific wave of it going around, and it looks distinctive enough to be worth naming. If the fake enquiries landing in your inbox have US phone numbers in them, start here.
If your form has started sending you enquiries from people with US phone numbers starting 202-555, generic names and random email addresses, you are not alone. We have seen the same pattern appear across multiple client websites recently, on different hosting, built differently, using different form plugins.
Most of them follow the same shape:
Some even mention your business name, which makes them look legitimate at first glance. The bot has simply scraped it from your website.
The 555 phone numbers are the giveaway. That range is reserved for fictional use, the one you see in films, so bots use it to get past phone number validation.
Not that long ago, website spam was relatively easy to recognise.
Most messages contained obvious spelling mistakes, random links or generic sales pitches that had clearly been copied and pasted across thousands of websites. Basic CAPTCHA tools were often enough to stop them, and even when the occasional message slipped through, it was usually obvious that it wasn’t a genuine enquiry.
Today’s spam is very different, and there’s more of it. That isn’t down to a single technology or one major event. It’s the result of several changes that have all happened over a relatively short period of time.
Artificial intelligence has made it significantly easier to generate convincing messages at scale. Modern bots no longer rely on the repetitive scripts that security systems learned to recognise years ago. They can write in natural language, vary their wording and mimic the way real people browse, pausing before they submit or rotating between IP addresses so they appear more like genuine visitors.
At the same time, websites have become easier to discover. Businesses invest in SEO, Google Ads and faster hosting to improve their online visibility, which is exactly what they should be doing. However, increased visibility doesn’t only attract potential customers. It also means search engines, AI crawlers and automated bots can find your website more quickly.
There’s also been a fundamental shift in how businesses operate online. Twenty years ago, most enquiries happened over the phone or in person. Today, contact forms are often the primary way customers request quotes, book appointments or ask questions. As those forms have become more valuable, they’ve naturally attracted more attention from automated systems.
Rather than targeting a specific business, these systems continuously scan the internet looking for publicly accessible forms. Your industry, location or company size doesn’t matter. If your website allows customers to get in touch, it’s likely to be discovered eventually.
None of this means your website is insecure. It simply reflects the way the internet now operates. What it does mean is that basic protection that worked five or six years ago is no longer enough on its own.
This is the part most business owners never hear, and it is the reason the current wave looks so strange.
The email addresses in these submissions often belong to real people who have no idea they are being used. The likely reason is an attack called email bombing, or subscription bombing. Criminals submit someone’s email address into thousands of website forms at once, so the victim’s inbox floods with confirmation and reply emails.
The aim is usually not harassment. It is to bury a single legitimate email that arrives during the flood, hiding a fraudulent transaction or an account takeover until it is too late to stop it. Because every message in the flood is a genuine signup from a real business, each one passes normal spam checks, which is exactly what makes the attack so hard to filter.
In other words, your website is not the target. It is being used as one of thousands of tools in someone else’s attack.
This is not a fringe problem. In February 2026, Switzerland’s National Cyber Security Centre reported a growing number of subscription bombing cases, noting that victims were receiving hundreds or thousands of confirmation emails within minutes. Proofpoint has documented the same pattern, and security researchers note that email bombing has climbed sharply over the past year, with botnets signing a single address up across many online services at once.
This is the biggest concern we hear, and the answer is usually reassuring: not on its own, no.
Your email inbox is the closest comparison. Most businesses get spam email every week, and that doesn’t mean the account has been compromised. It means the address is public and automated systems found it. Contact forms work the same way.
What matters is whether anything else is happening alongside it. If the site loads normally, genuine enquiries still come through and the only change is more spam, that’s the internet doing what it does.
These are the signs actually worth investigating:
When we look into a site with a spam problem, we check software updates, security settings, firewall rules, form configuration and server activity before drawing any conclusion. Most of the time the site is healthy, and the only thing that’s changed is the volume of automated traffic hitting it.
Deleting the fake enquiries is annoying. The bigger risks are less obvious.
Your lead data gets distorted. If form submissions are tracked as conversions in Google Ads or GA4, bots are inflating your results. Google’s automated bidding learns from those fake leads and can start chasing more of the wrong traffic, with real budget.
Your email reputation can suffer. If your form sends an automatic reply to whoever submitted it, your business email is now sending messages to strangers who never contacted you. Enough of that can affect how reliably your genuine emails reach inboxes.
Your CRM fills with junk. If enquiries flow into a CRM, fake contacts can trigger follow-up emails, SMS and automations. That wastes time, and on some platforms it wastes money per contact too.
None of this shows up as a broken website. It shows up as worse campaign performance and a messier pipeline, which is why it often goes unnoticed for months.
Bots are getting smarter. Many now run headless browsers and execute JavaScript, so a single layer of protection often is not enough. The most reliable approach is to stack a few simple defences, and most of them are free.
Cloudflare Turnstile is free and runs in the background, so genuine visitors rarely see a challenge. WPForms supports it natively, and Elementor forms can use it through a free plugin. Google reCAPTCHA is an alternative, although Turnstile is usually less intrusive.
A honeypot is a hidden field that humans cannot see but bots fill in automatically. Any submission that completes it gets blocked. Most form plugins, including WPForms and Elementor Pro, include one. It takes about a minute to switch on.
If you only serve Australian customers, set your phone field to accept Australian numbers only. If you take international enquiries, as tourism and accommodation businesses often do, block the 555 pattern instead.
If your form emails the person who submitted it, consider whether you actually need that. Turning it off stops your business from being used as a tool in email bombing attacks.
If enquiries flow into a CRM or automation platform, add a filter that flags fake phone patterns and known junk before a contact is created. This also stops fake leads from being counted as conversions and skewing your ad reporting.
The five fixes above deal with the current wave. These keep your forms healthy over time:
None of these steps is difficult on its own. Together they create a far stronger foundation than any single security feature.
Should I reply to the spam enquiries?
No. Do not reply, call the numbers or click any links. Mark them as spam in your form plugin and delete them.
How much does it cost to fix spam enquiries?
Usually nothing beyond setup time. Cloudflare Turnstile, honeypot fields and phone validation are free in most form plugins. If you need a developer to set it up, it is typically a short job.
Will adding spam protection stop real customers from contacting me?
Not if it is set up well. Turnstile and honeypots work in the background, so genuine visitors can submit your form as normal.
Why did the spam start suddenly across different websites?
These attacks come in waves. Bots scan the internet for any public form, so one campaign can hit thousands of unrelated websites at the same time, regardless of hosting or how the sites were built.
New Wave Digital Marketing helps local service businesses across South East Queensland keep their websites and lead tracking clean. If spam enquiries are clogging your inbox or skewing your ad results, get in touch and we will check your forms, tracking and CRM setup.
Free calculator
Most business owners have no idea how much revenue their Google ranking is leaving on the table. Find out yours in 2 minutes.
Calculate What #1 Is Worth →Free · No sales call
