Who is Abe Torkelton? - finding a webform bot
A recent web form hit made me curious, and a little bit of digging showed interesting behavior. Here's a bit about the observable anatomy of a form crawler bot going by the alias of "Abe Torkelton".
The bot has been tracked before, and apparently may show up as "Jorge Gonzales" leaving a phone number of 617-750-5939.
Hundreds of websites show in Google with hits from a registered user with a user string in the form:
Abe ???Torkelton????@cape-mail.comThe first three wildcards are letters, the last four are numbers - apparently part of a unique ID for the testing bot. Many more of these registrations can be seen by simply googling for either "Abe Torkelton"or "cape-mail.com".
The domain itself is registered through a domain proxy service run by gkg.net. This effectively hides the identity of the person running the bot.
What is the data being used for? I don't know yet - but somebody is finding every web form that they can submit user data to across the Internet, and they're seeing how those websites respond. Check your logs folks - this one is interesting to see.
UPDATE:
Thanks to comments on this post, I've posted an update.