The message arrived at a Squarespace contact form this week:
"DEAREST BELOVED, I am writing to inform you of an URGENT business proposal worth €4,500. My…" · Mr. Adebayo Williams · barrister.adebayo@protonmail.comVerdict from our classifier:
Classic advance-fee scam: an unsolicited offer of money from a stranger, with a request for personal banking details.
It was quarantined. The site owner never saw it in their normal inbox. They saw it in the Pengon dashboard, tagged spam, with one click to recover it if we got it wrong (we didn't).
What's interesting isn't that we caught it. It's which layer caught it. Eight of our nine layers, the cheap ones we run first to keep AI inference costs down, correctly let this message through. Only the ninth one could actually see what it was.
The pipeline, briefly
Every submission that hits Pengon goes through a defence-in-depth pipeline, ordered cheapest-first. The gist:
| # | Layer | What it does | Cost |
|---|---|---|---|
| 1 | IP blocklist (KV) | Refuse submissions from IPs we've seen abuse | <5ms |
| 2 | Payload size cap | Refuse bodies over 32 KB | 0ms |
| 3 | Site lookup | Find the customer's site config | ~10ms |
| 4 | Origin verification | Refuse if Origin doesn't match registered domains | 0ms |
| 5 | Page-load token | HMAC + ≥800ms timing, refuse if the browser didn't actually load the form | ~1ms |
| 6 | Per-IP rate limit | 30/min per IP | ~2ms |
| 7 | Per-site rate limit | 60/min per site | ~2ms |
| 8 | Field-length caps | Truncate huge fields so AI inference cost stays bounded | 0ms |
| 9 | Pipeline (cheap heuristics → AI classifier) | The actual classification | <2s |
The simple checks stop the obvious junk first, before we pay for an AI call. The AI reads the rest. That's the point: AI is the most expensive layer, so we don't spend it on messages the cheaper checks have already stopped.
For Mr. Adebayo, every cheap check passed.
Walking through the layers
Layer 1 (IP blocklist): First time we'd seen this IP. ✓ pass.
Layer 2 (Payload cap): A "DEAREST BELOVED" letter is under a kilobyte. ✓ pass.
Layer 3 (Site lookup): The site exists and is active. ✓ pass.
Layer 4 (Origin verification): The submission came from the registered Squarespace domain through our line of code. ✓ pass. (If this had been a headless script hitting /v1/check directly, layer 4 would have marked it as suspicious. It wasn't. It was a real browser, on a real page, with a real form submit.)
Layer 5 (Page-load token): A real browser fetched /v1/token when it loaded the form, waited the human-required 800ms minimum, then submitted with a valid HMAC. ✓ pass. The scammer (or their tool) is rendering pages, not POSTing blind.
Layer 6 (Per-IP rate limit): One submission. ✓ pass.
Layer 7 (Per-site rate limit): One submission, well under 60/min. ✓ pass.
Layer 8 (Field-length caps): Message comfortably under 10,000 characters. Truncation didn't fire. ✓ pass.
Layer 9 (Pipeline → AI): Inside layer 9 the cheap signals ran first: the hidden trap field was empty (it was a real browser, so nothing filled it), ProtonMail isn't on the throwaway-email list (it's a real, legitimate provider), the message doesn't contain literal phrases from our keyword list ("crypto", "investment opportunity", "rank #1"). Cheap-layer score: low. AI gets called.
Update, 28 September 2026: this scam was caught when Pengon's AI layer ran on Mistral Small 3.1. It now runs on Jev, a model built specifically for this kind of judgment call. The layer does the same job, faster. Two more things have changed since then. The early layers (blocklist, origin, token, rate limits) no longer refuse a message outright: they mark it, and it is still checked, without the AI. And the dashboard now shows a short label such as "Scam" in place of a sentence.
The AI reads the message and returns:
"Classic advance-fee scam: an unsolicited offer of money from a stranger, with a request for personal banking details."
The verdict lands above our spam threshold. Blocked.
Why the AI was the right layer here
This is a 419 scam, the genre named after section 419 of the Nigerian criminal code, the most-trained-on spam pattern in any modern LLM's corpus. The AI instantly recognized:
- The salutation pattern (
DEAREST BELOVED, exclusively used in advance-fee letters, never in real correspondence) - The windfall shape (
€4,500, an unsolicited sum from a stranger paired with a vague "business proposal") - The implied banking-details request that always follows
Could we have caught it with a keyword list? Yes, by adding "DEAREST BELOVED" and "barrister" and "business proposal" to the keyword layer. But every one of those strings appears in legitimate correspondence too. A keyword filter aggressive enough to catch this would also flag the lawyer writing a real proposal email and the customer who unironically greets you with "Dearest Friend". Over-flag and you lose the customer's trust faster than the spam ever could.
The AI doesn't have to choose. It reads the message in context. It sees DEAREST BELOVED + unsolicited money from a stranger + ProtonMail address + no specific business detail and recognizes the pattern. A real lawyer with a real proposal writes nothing like this.
This is the spam class the AI layer exists for: semantically obvious to a human, structurally clean on every other signal.
What the earlier layers DO catch
For balance, here's what the earlier layers deal with before AI ever runs:
- Layers 1, 6, 7 kill scrapers and rotation attacks: anyone POSTing thousands of forms a minute from the same IP, or one IP rotating across thousands of site_ids
- Layer 4 flags anyone who scraped a
site_idfrom public HTML and tried to abuse it from outside the page - Layer 5 flags headless bots that don't render JavaScript long enough to fetch a token
- The cheap checks inside layer 9 stop messages from throwaway email addresses (mailinator, tempmail, etc.) straight away. A "salesbot@gmail.com" style address or obvious 2010-era keyword spam ("rank #1 on Google", "casino", "viagra") raises the score
The first 8 layers handle the volume. The 9th handles the cleverness.
Where this is going
The 419 family is well-defined and stable: the templates haven't meaningfully changed since the early 2000s. Catching it is routine for the AI, which leaves our attention for the harder cases: the polished AI outreach, the "warm lead" pretenders and the stealth-startup pitches we've written about elsewhere.
For now though, this is the model working as designed. Eight cheap layers triaging volume. One smart layer reading meaning. A "€4,500" letter never reaching the inbox.
Pengon is an AI spam filter for Squarespace contact forms. We're in our founding-member window: $149 USD once, lifetime, first 20 seats (then $299), or start a 21 day free trial, no credit card. Built in Zürich by Quad Studio.