Wednesday, October 10, 2007

Who is Abe Torkelton? - finding a webform bot

A recent web form hit made me curious, and a little bit of digging showed interesting behavior. Here's a bit about the observable anatomy of a form crawler bot going by the alias of "Abe Torkelton".

The bot has been tracked before, and apparently may show up as "Jorge Gonzales" leaving a phone number of 617-750-5939.

Hundreds of websites show in Google with hits from a registered user with a user string in the form:

Abe ???Torkelton????
The first three wildcards are letters, the last four are numbers - apparently part of a unique ID for the testing bot. Many more of these registrations can be seen by simply googling for either "Abe Torkelton"or "".

The domain itself is registered through a domain proxy service run by This effectively hides the identity of the person running the bot.

What is the data being used for? I don't know yet - but somebody is finding every web form that they can submit user data to across the Internet, and they're seeing how those websites respond. Check your logs folks - this one is interesting to see.


Thanks to comments on this post, I've posted an update.


Chuck Norton said...

Me too. at, which doesn't have any linkage yet - so i'm not too sure how they found me.

Greg said...

My web site,, got hit by this bot as well.

Sister Sunshine said...

I got hit by what I think is a variant: and my site is

Curiouser and curiouser.

Wes Viola said...

me too - my domain is, i got a hit from

however, my mailing list form also stores the user's IP address.

would this be useful to anyone?

Eduardo said...

I received his request today too!
Nombre - abe Torkelton
E-mail -
Usuario - knjTorkelton7650

Im in Mexico City, my site:

I delete him from my database, but in the middle I made a backup from all.


RonDee said...

Message = Praise
Comments =
Name = ABe Torkelton
Address = 198 Tremont Street, # 506
Phone = 6175075939

The above was left on mine. If the user has an email address it is automatically put in.

Very odd!

David said...

Thanks all for your comments - I'll keep adding these to my notes in case they prove useful.

Wes Viola said...

The ID address I got was

KateR said...

I got one too... submission to my band's email list at :

Abe torkelton


198 Tremont Street, Box 506

198 Tremont Street, Box 506






From IP:

Salmon said...

At my site
I got:

name = abe Torkelton
email =
phone = 6175075939

email didnt work either...

ecobookers said...

me too at
email address sign up for a newsletter strange.

Unknown said...

He got me too on

bluesphee said...

I just received one too. Unfortunately for me I left a message after finding out that this is a bot. Any information on what this information is being used for? I left my name and a phone # since I run a business.

Unknown said...

My website,, got hit too.

No other information was supplied other than "Abe Torkelton" and the email "". I can supply the IP from my logs if that's helpful.

Lyme Regis SelfCatering Flat said...

Me too. I had a request for me to send a pdf of my brochure for holiday flat on
Entered Abe as name and torkelton as email address, so I was just googling the name in the hope of finding an email address when I found this site. Can't contribute anything technical as I am a real newbie at this. Joan G

SquigY0 said...

Apparently, bots don't rest on Thanksgiving!

Below is the result of your feedback form. It was submitted by
() on Thursday, November 22, 2007 at 21:47:03

Artist: ABE Torkelton

Song: Abe TOrkelton

Requestor: Abe Torkelton

Message: 28


Buckner GATES / Primary Talent Pool said...

got hit today at No info other than Abe Torkelton

BS said...

Abe just visited and completed the web form nominating a business to advertise. The business name was quoted as "Abe torkelton", the address was completed as "198 Tremont Street, Box 506, Boston" and the URL was quoted was The email address field was left blank.

Unknown said...

Got hit last week at Tried to call the number and get an answering machine.

Does seem strange what some folks try to do, Real question is why?

Michael Gandy said...

I think this just happened to me. Ive been receiving post to my contact form page that aren't real submissions. Thanks for the information I don't understand why people feel the need to create such bots, but what do I know.