Email Spam and the Form Channel

Technical assistance
1
  • Used Zammad version: 7.0.2-1781669454.9dc15acf.noble
  • Used Zammad installation type: package
  • Operating system: Debian

Lately, I’ve noticed a lot of spam tickets being created via my website form, which is Zammad-powered. I’ve also noticed that they are giving a bogus name/email pair, and all have a random alphanumeric string of about 15-22 characters for the message/body.

Now, Given captcha and the like are not an option, I decided to just do a little ModSecurity tweak to catch the bogus messages and 403 them. However, I’m curious as to whether anyone else is seeing this type of traffic and what you are doing to prevent it. The IPs that are originating this are all Tor exit nodes, and it is not frequent enough to trigger the rate limit.

I originally tried to tie some JS to the form and block it from submitting tickets with said message/body; however, it appears they are either bypassing it or perhaps getting the needed information right from the api to get a token and submit the ticket.

2

Update first please, especially for a publicly exposed instance, this has critical priority.

The current pre-release seems to include exactly the features you need.

3

Yup, did that this evening. Had to update the repo info, as it was maxing out at 7.0.2 for some reason. That being said, I noticed the notes in the prerelease, and that would be an awesome improvement; however, I was more so curious if anyone else was seeing this behaviour.

Just seems like an odd thing. Just to update, implementing ModSecurity bit has at least gotten them to stop as after a few 403s they have not been back.

4

The repository changed with the 7.1 release. It was a breaking change info I believe. Hard cut in that case.