The Phishin' Magician

I'm not referring to North Central Washington's own Dave Graybill, but a different kind of phisherman. This phisher is looking to catch people, or more accurately, people's information.

Yesterday I receive a message that says nothing more than, "I liked your site" from someone with a long and peculiar email address. The first thing I check on his email address is the domain name, the part of the email address after the "@" symbol. The domain name doesn't have a website attached to it, this is always a sign of something mischievous. So after some searching around I find out all I need to know about this person.

He uses an auto-form filler to fill out forms on websites and has done this to hundreds if not hundreds of thousands of websites. He typically writes "I like your site" or something very similar. Each time he uses an unique email address, for example, "hisname12345@example.com", "hisname14235@example.com", and so on. His only hope is that someone will reply with a simple "thank you" email. Once he gets your email address, he can sell it to spammers, spam it himself, or begin dialogue like asking you more and more personal questions.

The great thing about form spammers is that unlike email spammers, a form spammer can't fake his IP address as easily. For instance, using an ARIN search I know exactly which web hosting company this spammer uses and how to contact them and let them know someone has been abusing their service.