# Check new HubSpot leads for spam and malicious domains

> Every inbound form fill gets its email and website domains checked for known abuse, so reps skip the junk and your sequences stay clean.

- Workflow type: agent
- Services: VirusTotal, HubSpot, Slack Bot
- Categories: Sales
- Published: 2026-08-10

## What it does

- Runs the moment a new contact is created in HubSpot, so screening happens before anyone picks up the phone.
- Checks the domain behind the lead's email address and the domain of their company website against threat intelligence from more than 70 security engines.
- Writes a clear verdict of legitimate, low quality or malicious onto the contact record, with a note showing exactly what was found and why.
- Pings your revenue operations channel only when a lead is genuinely malicious, so the alert always means something.

## What you'll need

- A HubSpot account collecting contacts from your inbound forms
- A VirusTotal account, the free plan is enough for typical inbound volume
- A Slack workspace with a channel for your revenue operations team
- A contact property in HubSpot to hold the lead safety verdict, which you can create in a minute

## Prompt

When HubSpot sends a contact creation webhook for a new inbound form fill, screen the contact for spam and fraud before a salesperson wastes time on it.

Take the contact ID from the webhook payload and read the record with HubSpot Search Contacts, pulling at least the email address, the first and last name, and the company website property. If the record is not returned on the first attempt, wait a few seconds and try once more, since the webhook can arrive marginally before the record is queryable.

Derive up to two domains to check. Take the domain part of the email address, meaning everything after the @ sign. Take the domain of the website property, stripping the scheme, any www prefix, and any path or query string. Skip the email domain check for free consumer mailbox providers such as gmail.com, outlook.com, yahoo.com, hotmail.com and icloud.com, because a personal mailbox tells you nothing about the company behind the lead. If the email domain and the website domain are the same, look it up only once.

Look up each remaining domain in VirusTotal with Get a Domain Report. From each report read last_analysis_stats.malicious, last_analysis_stats.suspicious, and the reputation score under attributes.reputation.

This is the single most important rule in the whole workflow: absence of data is not a bad signal. A brand new but perfectly legitimate company domain will very often have no VirusTotal history at all, and a 404 NotFoundError simply means the domain is not yet in VirusTotal. Treat a 404, an empty report, or a thin report with zero detections as unknown, never as suspicious. Only ever flag on positive detections. Flagging on missing or thin data will quietly suppress good leads, which costs far more revenue than letting a little spam through.

Judge the lead as exactly one of three verdicts. Legitimate when no engine reports either domain as malicious or suspicious, and this explicitly includes the case where VirusTotal holds no data on the domain at all. Low quality when there are only weak signals, for example a small number of suspicious detections with no malicious ones, or a clearly negative reputation score without malicious detections. Malicious when one or more engines report either domain as malicious.

Write the verdict back onto the record with HubSpot Update Contact into a lead safety property. Use a custom contact property such as lead_safety_status, and set it to the plain verdict value so it can be filtered on in lists and sequence enrolment criteria.

Attach the supporting evidence with HubSpot Create Note, associated to the contact, so the rep can see exactly why. The note should state which domains were checked, the malicious count, the suspicious count and the reputation score for each, and one plain sentence explaining the verdict. Where VirusTotal had no data on a domain, say so explicitly and state that this was not counted against the lead, so the rep reads it as unproven rather than risky.

Only when the verdict is malicious, send a message to the revenue operations channel with Slack Bot Send a Message. Include the contact name, the email address, which domain or domains triggered the verdict, the detection counts, and a link to the HubSpot record. The purpose of the alert is so somebody can suppress the contact before it enters an email sequence and damages the sending reputation of our domain. Do not post anything to Slack for legitimate or low quality leads, so the channel stays worth reading.

Be careful with rate limits and failures. The free VirusTotal tier allows four requests a minute, so pace the domain lookups rather than firing them together. If VirusTotal returns a rate limit error or a transient error, retry with a short backoff. If it still cannot be reached, write the verdict as unknown, note the lookup failure on the record, and do not alert Slack, because a failed lookup is not evidence of anything.

## How to customize

- Move the bar for what counts as malicious. By default a lead is only flagged when security engines actually report its domain, and you can make that stricter or looser.
- Send the alert somewhere else, such as a marketing ops channel or a direct message to whoever owns sending reputation.
- Screen only the leads that matter by limiting it to specific forms, lifecycle stages or lead sources.
- Add your own safe list of partner and customer domains that should always skip the check.

## Example output

Note attached to the contact record:

Lead safety check: Malicious

Checked 2 domains for this contact.
Email domain (secure-invoice-pay.top): 8 engines report it malicious, 3 suspicious, reputation score -41.
Website domain (secure-invoice-pay.top): same domain as the email address, checked once.

Verdict: Multiple independent security engines classify this domain as malicious, which is a positive detection rather than a lack of history. Do not work this lead and keep it out of any email sequence.

Slack message to #revenue-ops:

Malicious lead blocked before sequencing
Contact: Dana Whitfield, dana@secure-invoice-pay.top
Domain flagged: secure-invoice-pay.top (8 malicious, 3 suspicious, reputation -41)
Suppress before this enters an email sequence. Record: https://app.hubspot.com/contacts/12345/contact/98765

## FAQ

### Will this reject good leads from brand new companies?

No, and this is the most important rule built into it. A brand new but perfectly legitimate company often has no threat intelligence history at all, and no history simply means nobody has looked at that domain yet. The workflow only ever flags a lead on positive detections, so an unknown or thin result is treated as unproven rather than risky, and the note on the record says so in plain words.

### Does this work on HubSpot Free?

For most teams, yes. You need to be able to store the verdict on the contact record and let HubSpot notify us when a contact is created. Custom contact properties are available on the free tier, though there are limits on how many you get, so check your plan if you already use a lot of custom fields.

### How many leads a day can the free VirusTotal plan handle?

The free plan allows roughly 500 lookups a day. This workflow uses at most two per lead, one for the email domain and one for the website, and often just one when they match, so somewhere around 250 to 500 inbound leads a day fits comfortably. Higher volume teams can move to a paid plan.

### What happens to leads that come back clean?

They get the verdict written onto the record and a short note explaining what was checked, then nothing else happens. No Slack alert, no interruption, and your rep works the lead exactly as normal with a bit more confidence.

### Does this actually stop a bad lead from being emailed?

It gives you the switch to do that. The verdict lands on the contact record as a property, so you can filter it out of your active lists and sequences, and the Slack alert tells a human to suppress it right away. That is what protects your sending reputation from bouncing off fake and malicious addresses.

Use this prompt in General Input: https://www.generalinput.com/prompts/check-new-hubspot-leads-for-spam-and-malicious-domains