alt Hacker NewsIf you're brave enough to want to see it yourself, visit https://archive.ph/jXv3A#:~:text=filed%20on%20Tuesday then click on the "Filed on Tuesday" link.
It redirected me to https://stolidityseashellshotter[.]com/ezrsb5dd1268e6f6ebaad... which then redirected me to a fake clone of RT news: https://rurtnews[.]com/
Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.
Edit: I clicked it a few more times and its redirecting me to either the fake RT or https://gullible-thanks[.]com/w5FDGi, which redirects to either https://sportshard[.]com/ or https://eatcells[.]com/land/?token=[a random string]
I had to disable uBlock Origin, since it does something to block many of these redirects.
Replies
> Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.
Well, this got on the front page of HN... Such things make even FAANG behemoths pay attention. What I mean is, who knows what happened since r/Seattle called it out.
Does some other archive, archive the archiver?
There might be a cryptographic solution for this problem, but that's far beyond my knowledge set.
Also, as the peer comment pointed out, it could be geo-scoped. You know, like a targeted attack.
The entire reason that I posted this originally is that I cannot think of a juicier userbase than HN. We all post archive.is links every single time. Given that operator's history, we are doing the link-click analogy of pasting shell commands from the web into our terminals. We should know better by now, but complacency leads to ___.
I wonder if the redirect target is region based, because my redirect took me to the fake Github page. I'm in the US. A fake RT article rhymes with the well established doppelganger propaganda campaign, which could rationalize why it would be region based. The irony of the doppelganger campaign being a Russian state-sponsored campaign is not lost on me.