3 ms·
One of the tweets (https://x.com/obtusatum/status/1755182704809635980?s=46&t=GxLKY6gkmAt-raxfowG6eQ https://x.com/obtusatum/status/1755182704809635980?s=46&t=Gx
by nneonneo 2y ago
One of the tweets (https://x.com/obtusatum/status/1755182704809635980?s=46&t=GxLKY6gkmAt-raxfowG6eQ https://x.com/obtusatum/status/1755182704809635980?s=46&t=Gx...) suggests one way this can happen: a fraudster sets up a server which returns a 302 for the Twitterbot user agent to an innocent domain (here, amazon.com), but directly shows malicious content for other user agents. For whatever reason, Twitter decides that the 302 target domain should be used for the preview, but clicking on the link goes to the original site.
I suppose this is some kind of ploy to keep URL shorteners happy (they get link traffic from Twitter; Twitter users get to see what’s behind the shortener), but the result is unabashedly bad for the users as the true link target is hidden.