Looks like a new address-harvesting trick: