I was hit with a pretty interesting report the other day - a user claimed some instance replicated their profile which isn't their official or real account.

I tried looking into the account or instance, but was immediately forwarded to spam and advertisement sites.

The instance is https://t.l3r.me/ identifies itself as a BirdSiteLIVE instance, that at least explains a "duplicate" account (the user was probably confused because this site imported their Twitter account with the same handle and name). However, I am not aware of any BirdSiteLIVE instance that automatically imports any user's accounts so that other instances index it allowing a user to discover it?

I tried importing my own Twitter account, which I don't use, and it didn't work. So it is not a functional BirdSiteLIVE instance (anymore)!

That is not the important part, however, what matters is that when you try to resolve the link, open an account on their page or interact with this domain at all, you're forwarded to advertisement webpages.

The link forwarded me to:

https://adonsonlyd.xyz/click.php?key=yn49syinibahv7946ad2&cpv=0.006&subid=336655927&kw=.de.subp.nonadult.windows.firefox&tt=tt

...then

https://www.ojrq.net/p/?return=https%3A%2F%2Favira.sjv.io%2Fc%2F2462623%2F1738092%2F18748%3FsubId1%3D9bdf3106-2040-41d4-803d-b9abb1b165a5%26sharedid%3D980977%26level%3D1&cid=18748&tpsync=yes&auth=5729ff03df2d8d0f

Then Avira Antivirus

https://www.avira.com/de/campaigns/acq/av/av_2y_affiliate_40?x-clickref=zgp231S68xyPTIsWYMXB-SUzUkHWN10xFX-h2k0&x-c-channel=affiliate_Impact&x-a-medium=affiliate&utm_source=Impact_2462623&utm_medium=affiliate&utm_content=1738092&utm_term=Impact_2462623&x-utm_term=Impact_2462623&IRID=2462623&irgwc=1

Maybe there's a possibility that this used to be a working Fedi instance and then once it was turned off the domain host turned it into a domain parking page for generating money through clicks (which would explain the ads).

The idea of an instance that duplicates profiles in order to generate fake clicks in order to make money off of ads seemed pretty grim, however.

Just wanted to share my findings! Stay away from this “instance”, block it, and delete everything stored in association with it!

#FediBlock #FediAdmin