Why would an .onion have different URLs for different users?

Question

I was recently invited to join a hidden bulletin board. In the note that was sent to me about it, the sender specified that the URL given to me was unique to me. A friend from Reddit was sent the same invitation bearing a different URL, unique to them, obviously.

Both URLs resolve to the same site, an innocuous phpBB install. I logged in and it seems to be a functioning phpBB site with different levels of access and nearly all posts blocked from new registrations but there's a few things I've noticed that send up red flags. It leads me to believe that this is some kind of elaborate phishing scam or some byzantine means of installing malware.

The thing is, registration only ever asked for a username and password that I don't use anywhere else on the internet. They were specific about this. I was never prompted for any further info that might identify me or be used in a way that could access other accounts linked to me. I've looked over the client-side source code and there's nothing obvious in there nor do I know of any malicious PHP.

But no one ever seems to be logged into the site. Post view counts never seem to increase. It's like I'm alone on this board and I'm trying to figure out its angle, if it even has one. Why would the URL be unique to me? Is this a common thing among .onion sites?

Any insight would be helpful.

Answer 1

Answering the subject question: different onions for different users (perfectly secreted from each other) is the technique for administrators to exclude any particular user simply by stop hosting specific hidden service. This is ideal "ban" in onion architecture, since banned user become powerless even in figuring out if service is still alive, forget about efforts of hacking or tracking physical location of service.

registration only ever asked for a username and password that I don't use anywhere else on the internet. They were specific about this.

Unique username is for anonymizing. Often such services work better if people can't identify each other, otherwise it can lead to some undesired consequences. Unique password is a default requirement for any service even in clearnet. This way accounts is more protected. That's it. Nothing especial.

But no one ever seems to be logged into the site. Post view counts never seem to increase.

This hides scale of service. This way adversary is troubled to make many good conclusions about service. The less data he had the less harm he can made.

So after all there is nothing suspicious in that service, taking into account it's anonymous nature. Just weird for inexperienced eye.