Hacker News

points by surround 1 day ago | 0 comments

If you're brave enough to want to see it yourself, visit https://archive.ph/jXv3A#:~:text=filed%20on%20Tuesday then click on the "Filed on Tuesday" link.

It redirected me to https://stolidityseashellshotter[.]com/ezrsb5dd1268e6f6ebaad... which then redirected me to a fake clone of RT news: https://rurtnews[.]com/

Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.

Edit: I clicked it a few more times and its redirecting me to either the fake RT or https://gullible-thanks[.]com/w5FDGi, which redirects to either https://sportshard[.]com/ or https://eatcells[.]com/land/?token=[a random string]

I had to disable uBlock Origin, since it does something to block many of these redirects.

[–] avidruntime 1 day ago

I wonder if the redirect target is region based, because my redirect took me to the fake Github page. I'm in the US. A fake RT article rhymes with the well established doppelganger propaganda campaign, which could rationalize why it would be region based. The irony of the doppelganger campaign being a Russian state-sponsored campaign is not lost on me.

[–] tyrabound 1 day ago

Without clear and irrefutable evidence, which is nearly impossible, the Vault 7 releases should have been more than adequate to quell any doubts that you can believe any kind of claim of foreign campaigns. Why would a V Russian operation link to a fake RT site? A discerning individual world always anime that whatever you are being directed towards is the least likely accurate/correct thing.

[–] qingcharles 1 day ago

This sounds like the same hack that took over btdig.com -- some weird sort of region-based redirect that doesn't affect everyone.

[in fact, I just tried btdig.com and it tried to redirect me to the same site: guillible-thanks.com or whatever]

[–] iam-py-test 14 hours ago

btdig wasn't hacked. The owner (same person at AT) added an advertising redirect in July.

[–] qingcharles 14 hours ago

How are you determining that they have the same owner?

[–] iam-py-test 13 hours ago

There is a lot of shared infrastructure between archive.today and btdig.com. For example, btdig is often hosted on the same IP as AT. The sites engage in the same behavior. Both sites engaged in DDoS attacks against gyrovague.com earlier this year. In June, both sites redirected Wikipedia users to Tehran Times. In July, both sites started redirecting to advertising sites. I have other evidence I can't share publicly, but the public evidence alone is sufficient to confirm a link.

[–] qingcharles 10 hours ago

Interesting. I didn't know that, thank you.

[–] consumer451 1 day ago

> Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.

Well, this got on the front page of HN... Such things make even FAANG behemoths pay attention. What I mean is, who knows what happened since r/Seattle called it out.

Does some other archive, archive the archiver?

There might be a cryptographic solution for this problem, but that's far beyond my knowledge set.

Also, as the peer comment pointed out, it could be geo-scoped. You know, like a targeted attack.

The entire reason that I posted this originally is that I cannot think of a juicier userbase than HN. We all post archive.is links every single time. Given that operator's history, we are doing the link-click analogy of pasting shell commands from the web into our terminals. We should know better by now, but complacency leads to ___.