> ## Content Index
> Fetch the complete content index at: https://internalnote.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Automatically deflect Zendesk spam tickets via triggers and webhooks
- URL: https://internalnote.com/automatically-deflect-zendesk-spam-tickets-via-triggers-and-web-hooks/
- Published: 2024-05-05T10:05:40.000Z
- Updated: 2024-11-03T10:55:14.000Z
- Description: From time to time spammers use open API endpoint in Zendesk to flood your inbox with tickets. This article shows an efficient and automatic way to deflect these tickets.
- Author: Thomas Verschoren
- Tags: Security & Privacy

For anyone using Zendesk in the last few days, the image below will be very familiar. All of the sudden your inbox gets flooded with spam tickets. They seem to originate from the web widget channel and contain Chinese characters.

![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2024/05/Screenshot-2024-05-05-at-11.39.03.png)

From what I can gather, and confirmed via other people contacting Zendesk, these tickets are created by spammers misusing the unauthenticated `api/v2/requests/` endpoint that's used to create tickets via webforms.

Preventing these tickets is not really possible since the only way to close the endpoint is to prevent [unauthenticated users](https://support.zendesk.com/hc/en-us/articles/4408820924954-How-do-I-remove-the-ability-for-customers-to-sign-up-for-our-account?ref=internalnote.com) from creating tickets, but that kinda defeats the purpose of having a Help Desk.   
  
Zendesk always finds a way to deflect this spam-attacks by adapting their firewall and content filter settings, but in the meanwhile, here's an easy method to handle these tickets.

# How to automatically mark tickets as spam.

## Step 1: Identifying the tickets

Any automatic filter can only work as long as you find a way to identify the tickets. In this scenario there's two approached I took:

First I created an organization QQ that has a linked domain *qq.com*, since that's used by most of these requesters.

![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2024/05/image-5.png)

Secondly I noticed that all these tickets have a similar structure in their subject *oZxQh用你IP帮我打婇嘌每天*`3OO伽qun`*858543602* so I can also use this to identify them.

💡

This part of the flow is always a bit of cat and mouse and you'll need to adapt your identifiers from time to time.

## Step 2: Webhook

🐛

May 6th - A previous version of this article showed a wrong placeholder in the web hook URL. This has now been fixed!

Zendesk has an endpoint to *mark tickets as spam and suspend end-users* which is documented [here](https://developer.zendesk.com/api-reference/ticketing/tickets/tickets/?ref=internalnote.com#mark-ticket-as-spam-and-suspend-requester).

In order to automatically call this endpoint and mark tickets as spam, we'll need to create a webhook.

1. Go to the admin center and navigate to *Apps and integrations > webhooks*
2. Add a new web hook with `https://subdomain.zendesk.com/api/v2/tickets/{{ticket.id}}/mark_as_spam` as the Endpoint URL and set the Request Method to`PUT`.
3. Authenticate with Basic Authentication with `admin@domain.com/token` as the username and a Zendesk API token as the password.

![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2024/05/Screenshot-2024-05-05-at-11.34.44.png)

## Step 3: Trigger

Finally, we'll need a trigger that will call the web hook if a potential SPAM ticket is created.

For the conditions, you can use the identifiers we defined in step 1:

- ALL: Tickets are created
- ANY:
  - Organization is `Qq`
  - Subject Text contains `3OO伽qun`
  - (add your own)

![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2024/05/spam_trigger_01.png)

![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2024/05/spam_trigger_02.png)

And for the actions, select the webhook we just created. You can leave the JSON body empty or leave the `{}` that's added by default.

💡

Note that API calls take a few seconds to execute. So it's best to put this trigger before any assignment triggers so the tickets don't temporarily end-up in your agents' views.

# Wrap up

Any **new** tickets that fall under your spam rules will now be automatically marked as spam and be suspended, no longer filing your views.

You can follow the suspensions executed by looking at the Activity tab of your webhook's configuration page in the Admin Center. Each successful suspension will be market with a Success:200 OK status.

![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2024/05/Screenshot-2024-05-06-at-20.30.14.png)

And if you check your Deleted or Suspended Tickets views, you'll be greeted with a list of tickets.

![](https://storage.ghost.io/c/ca/c0/cac0c82b-bc4d-4404-9eb4-9cc75e8d045e/content/images/2024/05/Screenshot-2024-05-05-at-11.56.09.png)

The only real maintenance here is that to keep an eye on spammers using some new format and updating your trigger accordingly.

💡

You can also use an automation that looks at the same identifiers and **tickets older than one hour* to clean up the backlog!

## Sign up for Internal Note

If you want more of these tips and tricks, sign up for our weekly email. And if this email saved you a few hours of work, consider subscribing to hour PLUS tier and support my work!

Subscribe 

Email sent! Check your inbox to complete your signup. 

No spam. Unsubscribe anytime.