CAPTCHA Social Engineering Experiment

I was thinking about how hard CAPTCHA images are getting to read these days and I had an idea.

I did a Google search for



I gathered the domain names of the first 50 results that did not have a "translate" link next to them, meaning they were likely to speak English.

I took a minute to generate a comma-delimited list of "support@domain" style email addresses from the list, and added that to the BCC field of an email I sent to myself.

The contents of the email was as follows.



Now, this is something I could write a script to do for me, hell it only took me maybe 15 minutes to do this for the first time by hand.

About 5 minutes after I sent the email I immediately received thirty 550 delivery status failure notifications because there was no "support@~" mailbox registered, and I got an email requesting that I fill out an extremely simple CAPTCHA to confirm I was a human.
Maybe 5 minutes after that I received an email with a link to a registration form that didn't have a CAPTCHA along with an assurance that if I was still having problems they would set it up manually for me.
After another 5 minutes I got an email with the username I requested and a password to use.

So out of those 50 addresses, I got two (4%) that would help me bypass a registration CAPTCHA. And there's still about 15 or so addresses that haven't responded in any way so far.
Now, it wouldn't be hard to have a script do a whois for each domain and gather the administration or technical emails instead of using a generic support@~

I really don't want to push it, so I'm not going to do any more than those original 50 emails, but I can't help but wonder just how many people unknowingly open the doors for spam bots on their forums like this.

Ok, this is taking spam to a new level!

I like it!

I think it is similar to how the virus messages bait users with "John has sent you an image - Please open the attachment". Some people open them!

Interesting. Think of the large scale on which that could be done! You could have quite an arsenal of forum accounts with which to spam!

This morning I received two more replies to my email.

The first one I probably could have talked my way out of (yet opted to explain what was going on to instead), but I think the second one knew something was awry.





In hindsight, the old "sorry wrong number" trick may have gotten me back under the radar in both situations.

I've received two notifications of delivery delays that will be retried for two days, and I have one more username and password setup for me.

So far I have a total of three responses out of 50 messages (6%) that would allow me to bypass a CAPTCHA pragmatically, and about a dozen more responses in limbo.

Interesting experiment, fascinating results. think of the possibilities They're lucky you're one of the good guys....

Good thing they were not in a bad mood when they read your email. That made me laugh a little.