All the buzz about Abe Torkelton: a followup

Since my post about "Abe Torkelton", a web form submission bot, we've had a lot of hits on the site and a few comments. I thought that a few of them were worth responding to here, as some of the details might be useful:

chuckn wrote:

"...[site] which doesn't have any linkage yet - so i'm not too sure how they found me."

The bot is likely either randomly or sequentially scanning IP space, or is checking registered hostnames via a registrar. In either case, even un-advertised system may be probed. Since the bot appears to look for web submission forms, the only way to hide from it will be to have some sort of human recognition system or pre-existing userID in place.

Thanks to Kate and Wes, we have IP addresses:

"The ID address I got was 64.5.40.122"

SamSpade.org resolves that to a ThePlanet IP range, which is different from what I originally saw. Kate posted and saw 66.232.97.32, which is a Hivelocity.net IP.

So we know that the Abe Torkelton bot is coming from multiple IPs. What we don't know is if it is tool, a bot, or the early stages of something more malicious. I have yet to see a report of the registrations being used for more than posting to a site.

How can you prevent it? Well, thus far it appears that human input required systems such as CAPTCHAs. Since the IP address is changing, you likely can't block it via IP, and blocking bots with derivations of "Abe Torkelton" will only save you until the name changes.

I'll keep tracking this here, so keep throwing what you find into the comments. Thanks folks!

Who is Abe Torkelton? - finding a webform bot

A recent web form hit made me curious, and a little bit of digging showed interesting behavior. Here's a bit about the observable anatomy of a form crawler bot going by the alias of "Abe Torkelton".

The bot has been tracked before, and apparently may show up as "Jorge Gonzales" leaving a phone number of 617-750-5939.

Hundreds of websites show in Google with hits from a registered user with a user string in the form:

Abe ???Torkelton????@cape-mail.com

The first three wildcards are letters, the last four are numbers - apparently part of a unique ID for the testing bot. Many more of these registrations can be seen by simply googling for either "Abe Torkelton"or "cape-mail.com".

The domain itself is registered through a domain proxy service run by gkg.net. This effectively hides the identity of the person running the bot.

What is the data being used for? I don't know yet - but somebody is finding every web form that they can submit user data to across the Internet, and they're seeing how those websites respond. Check your logs folks - this one is interesting to see.

UPDATE:

Thanks to comments on this post, I've posted an update.