Email Spam and the Form Channel

Technical assistance
1
  • Used Zammad version: 7.0.2-1781669454.9dc15acf.noble
  • Used Zammad installation type: package
  • Operating system: Debian

Lately, I’ve noticed a lot of spam tickets being created via my website form, which is Zammad-powered. I’ve also noticed that they are giving a bogus name/email pair, and all have a random alphanumeric string of about 15-22 characters for the message/body.

Now, Given captcha and the like are not an option, I decided to just do a little ModSecurity tweak to catch the bogus messages and 403 them. However, I’m curious as to whether anyone else is seeing this type of traffic and what you are doing to prevent it. The IPs that are originating this are all Tor exit nodes, and it is not frequent enough to trigger the rate limit.

I originally tried to tie some JS to the form and block it from submitting tickets with said message/body; however, it appears they are either bypassing it or perhaps getting the needed information right from the api to get a token and submit the ticket.

2

Update first please, especially for a publicly exposed instance, this has critical priority.

The current pre-release seems to include exactly the features you need.