I was recently invited to join a hidden bulletin board. In the note that was sent to me about it, the sender specified that the URL given to me was unique to me. A friend from Reddit was sent the same invitation bearing a different URL, unique to them, obviously.
Both URLs resolve to the same site, an innocuous phpBB install. I logged in and it seems to be a functioning phpBB site with different levels of access and nearly all posts blocked from new registrations but there's a few things I've noticed that send up red flags. It leads me to believe that this is some kind of elaborate phishing scam or some byzantine means of installing malware.
The thing is, registration only ever asked for a username and password that I don't use anywhere else on the internet. They were specific about this. I was never prompted for any further info that might identify me or be used in a way that could access other accounts linked to me. I've looked over the client-side source code and there's nothing obvious in there nor do I know of any malicious PHP.
But no one ever seems to be logged into the site. Post view counts never seem to increase. It's like I'm alone on this board and I'm trying to figure out its angle, if it even has one. Why would the URL be unique to me? Is this a common thing among .onion sites?
Any insight would be helpful.