Here's why Twitter sends you to a different site than what you clicked

A security researcher observed ads and posts on X (Twitter) that display a benign domain (forbes.com) in the platform's link preview while actually redirecting human users to a Telegram crypto-scam account via a redirector domain (joinchannelnow.net) that shows different destinations to bots versus browsers. The report details how the redirector inspects User-Agent headers to hide malicious or scam destinations from automated previewing, demonstrates the behavior with screenshots and third-party traces, and warns this deception can be leveraged for phishing, malware, or other fraud — especially on mobile where hover-preview is unavailable.