How is this website redirect working?

Question

Someone sent me a URL via WhatsApp (httpx://cadburys-prizes[.]com) that allegedly lets me claim a free box of chocolates. Obviously this is fake and I've seen similar websites before.

If I view the URL on my phone I end up at httpx://cadburys-prizes[dot]com/#forward where I'm prompted to answer some questions and then spam my WA contacts with further messages.

Viewing the source code for the page (by wget'ting it) , I can see a redirect to a bit.ly address. When I open the cadburys-prizes[.]com url on a (sanitized, virtual) desktop browser I get redirected to the bit.ly address which, judging from the URL, is a fake tech support site (the content is getting blocked by my network defences but I can imagine the scene).

What I don't understand is where the survey that shows on iPhone comes from? There is nothing I can see in the source of that page. Is it possible for an invisible proxy to be presenting a different index.html based on the user agent string? I did try to wget the page with mobile Safari UA but got the same result as without it.

Answer 1

There are various ways to fingerprint a client you're using. User-agent string is only a famous one. If you view the source code for cadburys-prizes[.]com, it uses meta refresh to redirect to httpx://bit[.]ly/2K1V332 after 2 seconds. It's possible that cadubrys-prizes may serve different content without using bit.ly. The bit.ly URL redirects to httpx://cash[.]trxmonetizer[.]com which seems to be doing the main job i.e. fingerprinting the client and presenting with whatever they feel like.

If it's doing everything on client, you can imitate any User-agent and inspect the response to dig deeper. However, it's also possible to do it on server-side for which they may or may not pass fingerprinting parameters in the request.