Will the owner of joinantifa.com please stand up?
I got linked to a joinantifa[.]com late last night and what a cluster f it is.
Besides the TERRIBLE blog posts. What draws my attention the most is the side bar of links and banner at the top. They’re all gross advertisements for things that leftists aren’t into, at least no anti-fascists I know.
The ads are also interesting because they’re mostly not dynamic, most are affiliate links and other short links.
Lets dig.
- http://bit.ly/CoinbaseOracle -> https://www.coinbase.com/join/cbenjamin_V_3rYg
- https://bitly.com/coinappxyo -> https://coin.onelink.me/ePJg/d851ffef
- https://bitly.com/strikelight2000 -> http://roguecfo.apesvl.hop.clickbank.net/?product=strikelight&tid=ABC
- http://www.minepi.com/lexknight
- https://bitly.com/2020webull -> https://act.webull.com/promotion/invitation/share.html?inviteCode=qFbTD4WBEwtU
- https://bitly.com/combat2000 -> https://35181hx740octxfa-ir9o6544w.hop.clickbank.net/ -> https://alphanation.com/combat-fighter/?hop=roguecfo
These are the links I pulled off the page that can be unfurled, followed and made from short to long.
Bit.ly links are the easiest and can be unfurled by adding a + to the end of the URL. Note: You’ll get some additional context on the link but bitly has mostly nerf’d this functionality.
There are two very interesting pieces of data from these links that we can infer.
- The name associated with the Coinbase referral link: Christopher Dylan - also note the url - “cbenjamin”
- “roguecfo” is a common string found in 3 of the affiliate links
Googling for “roguecfo” (in quotes) brings up the following information.
And with a little more digging into the first few results we can build the follow dossier.
Rogue CFO Consulting Chris Benjamin, (818) 528-5430 24250 N 23rd Ave, Phoenix, AZ 85085 chrisb@roguecfo.com http://www.roguecfo.com
How fortuitous! This guy has a lot of information out there by his own doing and isn’t trying to hide much, but the name doesn’t match what Coinbase is showing us, although the url is another piece of evidence.
Theres a referral link that uses different user than the rest: lexknight, and that difference leads me to believe there are more actors involved, can google help us?
Very little comes up when you google for “minepi” and “lexknight” but there is one page thats interesting
“Phoenix CDB” …. Phoenix, the location where Christopher Benjamin lives, CDB; Chris D Benjamin?
The associated YouTube account doesn’t have any content but can the string “Phoenix CDB” help us find more information?
The latest Tweets from Phoenix Chris (@phoenixcdb). Pilot, poker player, sports bettor, CFO, Mensa member, traveler and more. Phoenix AZ.
Oh thats good! “CFO” dude is the “Roguecfo” there arent many other results and the twitter account is suspended but what happens if we click images?
BOOM
I think this clearly identifies Chris Dylan Benjamin as the admin of joinantifa[.]com can we identify any other web properties under his ownership?
Let’s start with the referral links, out of all of them Coinbase is the most interesting as as a company they must adhere to strict KYC (Know Your Customer) policies.
Searching for the shortened referral link one of the top hits is a Pinterest account with a bunch of other ad looking social media posts.
There was an ad for Bovada casino on the side bar of the site that started this investigation.
This is the second time I’ve seen CDB use the word “Oracle” , its in the Coinbase bitly link! What else has he reused?
It took a bit of digging using tineye.com a reverse image search engine but I found this site using the same user image.
Checking out the host site, it looks strikingly familiar
Some additional context from the “ABOUT” page
About The Oracle
A Mensa member, MBA and overall intelligent guy, the Oracle started out by handicapping horse racing for several years. After taking an interest in professional and college level sports, I switched to handicapping sports games. I use a combination of statistical analysis as well as situational analysis for my “Crystal Ball” to come up with the best sports picks for me and you!
I live primarily in Las Vegas but travel to California & Phoenix often, both places I’ve also lived. When in Vegas you can usually find me at the Westgate, Aria or MGM sports books. I actually do 95% of my betting online, but enjoy hanging out at the sports books to mix and mingle with other bettors and take advantage of their huge tv’s and comfy seating.
I guess the final question I have to ask is “Why?”
Why did this guy take the time to setup joinantifa[.]com?
At first I thought it was a sinister disinformation campaign. A bad actor attempting to undermine the current social and political climate. However the more I learn about CDB and see how he operates, it just feels like a cash grab.
A guy, trying to build “provocative” or “triggering” content to go viral and get eyes to his affiliate funnels.
I hope this writeup provided some insight into how identities can be uncovered by sloppy actor tactics and free OSINT tools.