He could've probably sent him to a website which logged his OS, or somehow, got his IP and found out his TTL. or as was later mentioned a trojan could've been installed.