A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability here?
This is the link:
It sets up and sends some variables to youtube then logs me out and then sends me to a bitly shortened link:
I unshortened it and it came back with this :
The site is a Chinese search engine! When I clicked on this link on my VM, it went to this website:
hxxp://www.twitob.com/ which is some sort of gaining twitter follower site.
What is this link doing? I get that its setting some variables like ilo or ils and stuff, but I don't know what are they and why set them to these specific values? What are these variables?
I also found a report on a similar thing to this :
but not sure if they are the same vulnerability or not, and that report doesn't explain anything.
One more weird thing is that usually I can easily unshorten the twitter's
t.co links, but when I unshorten the
t.co link that twitter gave me for these links, it turned into this no matter which website i used :
But you can clearly see that the actual link is something way different, what is going on?