Why isn't the blocklist working for tickets created through the Web Widget (Classic) or the webform?
The blocklist only blocks tickets created with the email channel, unless a
reject: the modifier is added to the blocklist.
To block all tickets, use
reject:domain.com to block the domain or email of your choice.
In the example below, all tickets created by email@example.com will be rejected, regardless of the channel where their tickets were created.
For complete instructions on controlling access to Zendesk Support, see the article: Using the allowlist and blocklist to control access to Zendesk Support.
If you are experiencing a large spam attack through the web form, Web Widget (Classic), or API, see the article: How can I combat spam submitted via web service?