Horrendous amount of spam through contact us page

I consider this a "security problem" because 1. 10,000 emails a week and 2. weird things written, looks like code but...why? Code in an email is just an email unless clicking on a link. 3. not conducive to eCommerce...it's conducive to an anxiety attack!

Anyway, my contact us portion of zen was so bombarded. I had one guy send hundreds of emails through the form saying, look how i'm violating your contact form... contact us for a solution. It got so bad, i shut down the email and changed it on the site but... many (probably hundreds) of old customers kept emailing the email that replies to the contact form. Customers got frustrated with the service...lost some too.

This was before the upgrade. Was anything done to seal up this new open target? Is there a plugin for it? I see some posts back in 2018 about captcha. Any advice is appreciated. Thanks

Just to clarify:

• you posted this mentioning v157 in the Title, implying that it's related to v157
• you said all this spam happened "before the upgrade". Which old version was this spam actually related to?
• you called it a "new open target". How did you arrive at calling it "new"?
• is said spam still happening "after" the upgrade? How has its patterns changed since the upgrade?

DrByte:

Just to clarify:

• you posted this mentioning v157 in the Title, implying that it's related to v157
• you said all this spam happened "before the upgrade". Which old version was this spam actually related to?
• you called it a "new open target". How did you arrive at calling it "new"?
• is said spam still happening "after" the upgrade? How has its patterns changed since the upgrade?

Okay, sorry to offend DrByte. Not my intention to offend. I gotta watch how I put a sentence together. Let me clarify. This “NEW” problem, is “NEW” to me and it happened on 1.5.1 during 2020. It is an old problem? but new to me. Part of this is my fault because when I saw it happening, I let it go as I didn’t have a clue how to fix it and we are busy all the time. I remember coming on Zen and someone posted about a Captcha page..i eventually just killed the contact email as I have other emails but I had scores of customers who just kept that old email—they thought our customer service went south. Another site, the bombardment was so fierce, I just killed the contact page altogether. While I’m on the subject of mischief, I had to kill the Pay by Check for a full year one one site as the spammer opened accounts, purchased by check, never paid. This happened so much, could it be automated?
I just spent a couple hours sifting through this spam, trying to salvage some irate customers. I posted because I can’t go through this again and looking if it’s solved or if I need to find a way to stop it. I'm now on 1.57 and it's a good time to put a final solution to this chicanery.
Was it solved? As of right now, I’m getting only a few a day on two sites, we’ll see what happens on the third.

In v1.5.7 there's an anti-spam filter Observer Class that you can customize to add additional processing.
You can see the original file contents at:
https://github.com/zencart/zencart/blob/v157/includes/classes/observers/auto.non_captcha_observer.php

Its default implementation just filters out messages containing spammy http and ftp URLs.
But you can add more patterns to it. I think there's a forum thread about adding some customizations to see some of those ideas.

Sometimes it's worth looking for patterns in the spammy messages you're getting to see what you could reject using some automated rule.

Avoiding a full-on CAPTCHA tool is preferable, because there are bots and small human-armies that can crack those, and spammers even pay for those. Argh!

Okay, i'm on it. Thanks for the direction.