0

I talk in a security forum, and sometimes a moderator share links to sources about things he talk about, but when I hover on these links, the link is different the the source it self. It is actually a URL shortener that he himself built which associated with his website. I thought it is self profit.

I asked him why he does that

What personal gain are you talking about? Do you see an advertisement when you click on the link? You get 301 from the server, there is not even a BODY for response from the server.

And then he also added:

Think about how it can benefit someone who is in charge of providing resources in almost every one of his posts.

I'm the only one who can create shortcuts under this domain.

A. I do not see IP addresses in the UI.
B. I see countries of origin.
C. I see a referrer if the browser has not filtered (so I can theoretically know from which forum post they came).
D. I have nginx level logs where I can see an IP address. I only access this log if I have to worry about problems and even then I do not care about the addresses unless it is an attack.

Although I have log systems, the logs are not sent there, because this information really does not interest me. The answer obtained is 301 without content. No advertisements, so no personal gain.

What can it be? is it sounds like something malicious? I have clicked on his links.

8
  • 1
    Why do you think it's malicious? Commented Feb 26, 2021 at 22:14
  • There is nothing for us to tell you. We would have to actually analyse the service, which we won't do.
    – schroeder
    Commented Feb 27, 2021 at 0:29
  • @schroeder Why not? I mean, this forum is meant to help people solve their problem. At least speak for yourself, and not we won't do. Thank you anyway
    – div Mi
    Commented Feb 27, 2021 at 10:16
  • @multithr3at3d I am asking if it might be malicious based on the information I provided and based on your knowledge.
    – div Mi
    Commented Feb 27, 2021 at 10:18
  • 1
    I'm a mod. I speak for "we". This is not a site to help people "solve their problems". We are a Q&A site. That means that there is a certain style and requirements for questions.
    – schroeder
    Commented Feb 27, 2021 at 10:44

1 Answer 1

2

This does not sound like anything malicious or even special. It is not that hard to have personal URL shorteners which do just what the name suggest: provide a short URL. These are much easier to share with others than a long URL. There is no need to have extra functionality on top of this when all one wants to do is to provide a short URL.

Also, if somebody wants to share a malicious link they can do just this. It is not clear from a link what is behind it, i.e. not clear if it is malicious or innocent. A URL shortener does not add any layer of obfuscation here since it is not clear from beginning.

This is different with public URL shorteners though: a established and kind of trusted public URL shortener can be used to hide links to malicious resources behind a trusted site. But this is not the case here - the private URL shortener has no more trust than the long URL it points too.

3
  • He does not do that to short the URL. The forum has the same functionally as in StackExchange, he use [link](http://example.com). Therefore I still don't understand why he does that..
    – div Mi
    Commented Feb 27, 2021 at 10:16
  • @divMi: Then please don't call it URL shortener - a phrase which has an established meaning. What you describe in the comment is simply a link with a (short) description, nothing special about it. Also, it does not match your description regarding a redirect since [link](url) does not cause any kind of redirect. Commented Feb 27, 2021 at 11:01
  • Haha no, it is a URL shortener but it is also in a format like I sent above. I just said it doesn't the case you think (to make the link look better). He use both the format and the URL shortener to provide resources.
    – div Mi
    Commented Feb 27, 2021 at 11:03

Not the answer you're looking for? Browse other questions tagged .