Russian SPAM influx

We receive thousands of spams per day.  This problem exists since more than 3 weeks and freshdesk has no solution, that is absolut unacceptable!

Please freshdesk team, do you job!

My account has also been spammed from this address. I have set up a Dispatch'r rule following on from Donny's advice. Seems to be working for other users. Will report back if it helps/continues

Yesterday we also noticed another "perk" of FreshDesk

We merged two tickets together and the FD field names of the ticket being merged into the master ticket got translated for us to Cyrillic characters.  AWESOME sauce!

Snippet of both tickets included below - when we look at the original ticket, it's unchanged - but in the thread of the master, as mentioned - the fields for "Merged From" "subject" and "Description" are changed to friendly Russian (I think) letters

Awfully suspicious I think!

This is killing us as well. Looking for Freshdesk alternatives. This needs to stop.

I agree with Johnathon Voegeli.  This is not a cheap service, and in this matter, and other billing matters, there is no visible commitment from Freshdesk to retain their customers.  This is negatively affecting the way I run my business. 

We are also suffering from this very same issue. As the emails are directly addressed to a mail address in the Freshdesk domain, our corporate spam filters are not applied. We have implemented the workaround via the Dispatch'r, similarly as described in earlier comments. However, we require Freshdesk to come up with a decent and permanent solution so these crappy emails don't even hit the ticketing system and the Dispatch'r.

We were hit too. 739 tickets 12pm and 3pm yesterday. We will try the suggestions earlier, but it would be great to have a solution / tool from freshdesk for this kind of mass cleanup. We might as well build something with the API, but not every user is capable of doing so.

Has anyone an idea how to delete these messages? We have more than 5000 and I don't want to delete them all manually... 190 pages!

It seems like the attack is targeting a loop hole in Freshdesk: when you start a new Freshdesk account it contains an email address support@yourdomain.freshdesk.com. But even after deleting that email address from the Email Settings, the account still accepts emails to that address. This needs to be fixed by Freshworks, so that only emails to validated addresses are received into the account.

The workaround is to setup a Dispatcher rule to mark all emails to support@yourdomain.freshdesk.com as spam or delete them:

If you already have received 1000s of emails and don't want to delete them manually, I suggest to setup a Supervisor rule like this (remember that Supervisor rules are executed once per hour, so it might take up to one hour before the rule will run and the tickets are marked as spam or gets deleted):

I've got some info from Freshworks, saying that they are working on a fix for this problem. Unfortunately I didn't get any release date/time, but it's at least being worked on.

i've the same problem, after activate the rule the spam is over... but i've a large amount of spam contacts and i can't delete all together :(

@AlexPro take a look at my post (last post on page #4) suggesting how to set up a Supervisor rule to delete the tickets automatically

And to all of you writing that you are considering changing away from Freshdesk because of this I suggest you to think twice: This is a global problem, not only affecting Freshdesk. Zendesk's customers are having even more serious problems, as they in addition have experienced attacks both through a vulnerability in the ticket forms and by having their accounts used as relays for the spam. There is a similar forum post on Zendesks support pages: https://support.zendesk.com/hc/en-us/community/posts/360004196347-Russian-spam-37K-so-far-need-a-way-to-mark-them-all-as-spam

I've seen but my problem now is delete the contacts... the ticket are clean

Worked with support just now to setup a Webhook so that this issue does not also create new contacts with each new spam ticket. Here is there solution which worked for me. Change the url to match yours of course. I did have to manually delete the Contacts, perhaps a Supervisor rule could have done this, not sure.

Could you please go to the Dispatch'r rule and add the action, "Trigger Webhook" and follow the steps below?

1)Select the Request Type as "DELETE".

2)in the callback URL, enter the following-

https://yourdomain.freshdesk.com/api/v2/contacts/{{ticket.requester.id}}

3)Select the option, "Requires Authentication" and "I have API key?". Copy your API key from your profile settings and paste it here. Save the rule​ to delete the contacts who raise new spam tickets.

@Matt.lauer - THANK YOU (and support)!!!

However, we already 12k+ contacts created... so I hired my teenager to weed through all the bogus contacts, deleting 90 at a time. Painfully slow (for him) but at least he could earn a little income and I wasn't burning my guy's time with such a menial task. Nor did I want to plow efforts into programatically achieving the same thing.

I really do like FreshDesk - but think they need to own up to taking some responsibility and more publicly post about some of the solutions, vs folks digging through a thread!

We were also hit over the weekend and got more than 4000 emails. As we get legitimate emails from Russia, blocking Cyrillic characters is not an option for us. I blocked emails coming to the support@***.freshdesk.com email, I'm only afraid I'll block legitimate emails coming through that address also.

We have had over 10,000 spam Russian e-mail in the last week. We have rules in place to filter and put them in the trash but I can see they are still coming. I am most concerned as the e-mail address they are being sent to is not public-facing. It suggests a leak/hack has happened. How else would they know this internal Freshdesk e-mail address? I am concerned that our client details have also been leaked/hacked.

The worst thing about all of this is the complete lack of information from Freshdesk. Bad things happen but the way you deal with them makes all the difference. I have had numerous chats and sent e-mail but not a word back about what is happening or what is being done to stop it. 

This leaves us with no choice but to consider another provider. Freshdesk have completely dropped the ball on this one by failing to communicate to their clients. For an organisation that specializes in customer service solutions this is unbelievably bad.

We are currently talking to Zendesk and Accelo. If we don't hear an official response within a week we will be cancelling our account with Freshdesk.

thanks @Matt.lauer for sharing the webhook configuration.

@Freshdesk it would be nice to have a way to have some kind of control over the enabled support email addresses. Since we use a 3rd party email provider anyway we could then easily replace the compromised email address with a randomized one on demand. As of now we don't have a way to simply disable support@***.freshdesk.com and simply replace it with, 34jn59dyfgier5h@***.freshdesk.com.
(maybe we have this option and I just didn't find it)

I thought it was under control but on Monday we received another batch of about 200. While I have a rule in place, it keeps clogging up the recent activities feed.

We started to be hit with this matter yesterday as well. A few thousand emails were generated already. I would say this is a bit more than a nuisance. In practical terms for a company like ours means that someone actually woke with tens of hundreds of notifications overnight (being on call). It is also appalling that the remedy for the situation is being applied from the custoemr end and not from FreshDesk. To be honest the tailor-made spam filter activation does not leave me comfortable once we could actually have missed calls. 

We already have a dispatcher rule in place but it seems to not do the job 100% of the times, especially when the flow of incoming emails is clearly massive.

FeshDesk, please fix this from your end asap and improve the way you protect your data. Having bots targeting wildcards with phishing emails to your subdomains associated with customers is by far nor reassuring.  

Unfortunately moving away from FreshDesk is not an immediate solution for us and as someone said previously other competitors like ZendDesk also have similar issues.

In my optics, it seems that allowing us, customers, to use an email fetcher instead of using your own emails would be half of the way for preventing these issues.

In case this helps anyone else, use the Dispatch'r rule to filter for Russian characters as has been outlined previously in this ticket. You can then also add some actions to skip sending a new ticket notification on the spam ticket, mark the ticket as spam, delete the ticket, then delete the contact. Once we did these steps, our ticket count stopped increasing, the contact was no longer auto created for these spam tickets, and the ticket itself was marked as spam and auto deleted. 

Could you please go to the Dispatch'r rule and add the action, "Trigger Webhook" and follow the steps below?

1)Select the Request Type as "DELETE".

2)in the callback URL, enter the following-

https://yourdomain.freshdesk.com/api/v2/contacts/{{ticket.requester.id}}

3)Select the option, "Requires Authentication" and "I have API key?". Copy your API key from your profile settings and paste it here. Save the rule​ to delete the contacts who raise new spam tickets.

As an update from my post yesterday, we started receiving the SPAM tickets again overnight. They are all being marked as SPAM and the contacts are being removed, but the fact that they are reaching us at all is quite troublesome. Freshdesk, as I'm sure everyone in this thread would expect, have not been very helpful. Here's hoping they implement some SPAM filtering soon. 

@MarkMyles - I don't think your statement about the ticket counter not being increased is correct. The tickets are marked as spam, finish up in trash, the contact is not created, BUT the ticket is still given a number and the count increases.