urlscan.io logo urlscan.io
SecurityTrails logo

api.x.com Open in urlscan Pro
104.244.42.66  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://rb.gy/sz6lie
Effective URL: https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Submission: On December 11 via manual from PL — Scanned from PL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 13 HTTP transactions. The main IP is 104.244.42.66, located in United States and belongs to TWITTER, US. The main domain is api.x.com. The Cisco Umbrella rank of the primary domain is 4404.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on August 19th 2024. Valid for: a year.
This is the only time api.x.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Twitter (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 1 54.224.41.213 14618 (AMAZON-AES)
1 1 35.173.69.207 14618 (AMAZON-AES)
1 104.244.42.2 13414 (TWITTER)
8 104.244.43.131 54113 (FASTLY)
2 146.75.120.159 54113 (FASTLY)
1 104.244.42.66 13414 (TWITTER)
13 5
1    54.224.41.213 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-224-41-213.compute-1.amazonaws.com
rb.gy
1    35.173.69.207 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-69-207.compute-1.amazonaws.com
spoilyuki.pythonanywhere.com
1    104.244.42.2 (United States)

ASN13414 (TWITTER, US)
api.twitter.com
8    104.244.43.131 (United States)

ASN54113 (FASTLY, US)
abs-0.twimg.com
2    146.75.120.159 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
pbs.twimg.com
1    104.244.42.66 (United States)

ASN13414 (TWITTER, US)
api.x.com
Apex Domain
Subdomains		 Transfer
10 twimg.com
abs-0.twimg.com — Cisco Umbrella Rank: 4189
pbs.twimg.com — Cisco Umbrella Rank: 1497
99 KB
1 x.com
api.x.com — Cisco Umbrella Rank: 4404
4 KB
1 twitter.com
api.twitter.com — Cisco Umbrella Rank: 2070
4 KB
1 pythonanywhere.com
spoilyuki.pythonanywhere.com
299 B
1 rb.gy
rb.gy — Cisco Umbrella Rank: 142792
169 B
13 5
Domain Requested by
8 abs-0.twimg.com api.twitter.com
api.x.com
abs-0.twimg.com
2 pbs.twimg.com api.twitter.com
api.x.com
1 api.x.com abs-0.twimg.com
1 api.twitter.com
1 spoilyuki.pythonanywhere.com 1 redirects
1 rb.gy 1 redirects
13 6

This site contains links to these domains. Also see Links.

Domain
x.com
help.x.com
Subject Issuer Validity Valid
api.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-08-19 -
2025-08-18		 a year crt.sh
*.twimg.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-06-24 -
2025-07-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Frame ID: 152F8B9DD39A3B3DA78BDBDBE5368991
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

X / Autoryzuj aplikację

Page URL History Show full URLs

  1. http://rb.gy/sz6lie HTTP 307
    https://rb.gy/sz6lie HTTP 301
    https://spoilyuki.pythonanywhere.com/ HTTP 302
    https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw Page URL
  2. https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw Page URL

Page Statistics

13
Requests

92 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

107 kB
Transfer

295 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://rb.gy/sz6lie HTTP 307
    https://rb.gy/sz6lie HTTP 301
    https://spoilyuki.pythonanywhere.com/ HTTP 302
    https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw Page URL
  2. https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://rb.gy/sz6lie HTTP 307
  • https://rb.gy/sz6lie HTTP 301
  • https://spoilyuki.pythonanywhere.com/ HTTP 302
  • https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
authorize
api.twitter.com/oauth/
Redirect Chain
  • http://rb.gy/sz6lie
  • https://rb.gy/sz6lie
  • https://spoilyuki.pythonanywhere.com/
  • https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.2 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
20a15d2f9c28b5878d4a434c0371f5bb0f9736cd3414ad6d6364ff1e25083695
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src https://abs.twimg.com https://abs-0.twimg.com data:; frame-src 'self' twitter:; frame-ancestors 'self' https://tweetdeck.twitter.com https://tdapi-staging.smf1.twitter.com https://tdapi-staging.atla.twitter.com https://tdapi-staging.pdxa.twitter.com https://tweetdeck.localhost.twitter.com; img-src https://abs.twimg.com https://*.twimg.com https://pbs.twimg.com data:; media-src 'none'; object-src 'none'; script-src https://abs.twimg.com https://abs-0.twimg.com https://twitter.com https://mobile.twitter.com; style-src https://abs.twimg.com https://abs-0.twimg.com; report-uri https://twitter.com/i/csp_report?a=NVQWGYLXFVWG6Z3JNY%3D%3D%3D%3D%3D%3D&ro=false;
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

att
1-tQTXcZbzcFrHlQhUI3sEChVfv4W8QyRUXtKhYUFt
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-encoding
gzip
content-length
2440
content-security-policy
default-src 'none'; connect-src 'self'; font-src https://abs.twimg.com https://abs-0.twimg.com data:; frame-src 'self' twitter:; frame-ancestors 'self' https://tweetdeck.twitter.com https://tdapi-staging.smf1.twitter.com https://tdapi-staging.atla.twitter.com https://tdapi-staging.pdxa.twitter.com https://tweetdeck.localhost.twitter.com; img-src https://abs.twimg.com https://*.twimg.com https://pbs.twimg.com data:; media-src 'none'; object-src 'none'; script-src https://abs.twimg.com https://abs-0.twimg.com https://twitter.com https://mobile.twitter.com; style-src https://abs.twimg.com https://abs-0.twimg.com; report-uri https://twitter.com/i/csp_report?a=NVQWGYLXFVWG6Z3JNY%3D%3D%3D%3D%3D%3D&ro=false;
content-type
text/html;charset=utf-8
date
Wed, 11 Dec 2024 07:11:46 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Wed, 11 Dec 2024 07:11:46 GMT
ml
A
perf
7402827104
pragma
no-cache
server
tsa_f
status
200 OK
strict-transport-security
max-age=631138519
x-connection-hash
d871e321f8773c948f8798e2b6cbaf413c2dfbafd97cc28b873a5f59372262ad
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-response-time
258
x-transaction
d1499e47f394aac7
x-transaction-id
d1499e47f394aac7
x-twitter-response-tags
BouncerCompliant
x-ua-compatible
IE=edge,chrome=1
x-xss-protection
0

Redirect headers

Connection
keep-alive
Content-Length
345
Content-Type
text/html; charset=utf-8
Date
Wed, 11 Dec 2024 07:11:46 GMT
Location
https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Server
PythonAnywhere
X-Clacks-Overhead
GNU Terry Pratchett
redirect_x.f20424c5b392053b4fdeb62b1a10e3bdb8ffef5b.js
abs-0.twimg.com/login/ 		133 B
510 B 		Script
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/login/redirect_x.f20424c5b392053b4fdeb62b1a10e3bdb8ffef5b.js
Requested by
Host: api.twitter.com
URL: https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.twitter.com/

Response headers

x-transaction-id
3d70bef4c8e66810
content-encoding
gzip
etag
"Eza0F9ln459i4/5txW3I4w=="
x-content-type-options
nosniff
expires
Wed, 22 Oct 2025 07:04:06 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
perf
7402827104
content-type
application/javascript
x-served-by
cache-pdk-kfty8610046-PDK, cache-fra-eddf8230122-FRA
last-modified
Tue, 22 Oct 2024 04:17:53 GMT
vary
Accept-Encoding
strict-transport-security
max-age=631138519
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
101
tfw-base.495c9dbdc09e258208496e76f51cba5524b11132.css
abs-0.twimg.com/login/ 		27 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/login/tfw-base.495c9dbdc09e258208496e76f51cba5524b11132.css
Requested by
Host: api.twitter.com
URL: https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.twitter.com/

Response headers

x-transaction-id
f3a53f65dd75f3ef
content-encoding
gzip
etag
"Sw6Vd6RouWpqNQF4V6H+gQ=="
x-content-type-options
nosniff
expires
Wed, 12 Nov 2025 12:37:50 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
perf
7402827104
content-type
text/css
x-served-by
cache-pdk-kfty8610035-PDK, cache-fra-eddf8230122-FRA
last-modified
Tue, 12 Nov 2024 08:17:43 GMT
vary
Accept-Encoding
strict-transport-security
max-age=631138519
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
6594
base.7ced3ee3ff61dadf91a9c9bd7082adc8f158a360.js
abs-0.twimg.com/login/ 		110 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/login/base.7ced3ee3ff61dadf91a9c9bd7082adc8f158a360.js
Requested by
Host: api.twitter.com
URL: https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.twitter.com/

Response headers

x-transaction-id
815c456238fc2118
content-encoding
gzip
etag
"ni/3pFnHtfLdF8BCS5m2+Q=="
x-content-type-options
nosniff
expires
Thu, 17 Oct 2024 08:03:46 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
perf
7626143928
content-type
application/javascript
x-served-by
cache-pdk-kpdk1780034-PDK, cache-fra-eddf8230122-FRA
last-modified
Wed, 18 Oct 2023 06:18:02 GMT
vary
Accept-Encoding
strict-transport-security
max-age=631138519
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
39287
authorize_page.c4edf9ccaf94a42b6963991691957aaa827aa56b.js
abs-0.twimg.com/login/ 		2 KB
974 B 		Script
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/login/authorize_page.c4edf9ccaf94a42b6963991691957aaa827aa56b.js
Requested by
Host: api.twitter.com
URL: https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.twitter.com/

Response headers

x-transaction-id
5f335ccd2239d77b
content-encoding
gzip
etag
"76qrTfW/TZXmL7Vpk/RnSQ=="
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 12:50:55 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
perf
7402827104
content-type
application/javascript
x-served-by
cache-pdk-kpdk1780034-PDK, cache-fra-eddf8230122-FRA
last-modified
Wed, 06 Nov 2024 10:17:51 GMT
vary
Accept-Encoding
strict-transport-security
max-age=631138519
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
847
pjouLGED
pbs.twimg.com/app_img/1839595766710779904/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/app_img/1839595766710779904/pjouLGED?format=jpg&name=73x73
Requested by
Host: api.twitter.com
URL: https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.120.159 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.twitter.com/

Response headers

x-transaction-id
0eb390b95cd6d136
access-control-expose-headers
Content-Length
cache-tag
app_img,app_img/bucket/1,app_img/1839595766710779904
x-content-type-options
nosniff
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
last-modified
Fri, 27 Sep 2024 09:17:43 GMT
perf
7402827104
x-served-by
cache-lhr-egll1980034-LHR, cache-fra-etou8220133-FRA, cache-tw-ZZZ1
content-type
image/jpeg
strict-transport-security
max-age=631138519
cache-control
max-age=604800, must-revalidate
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
2626
Primary Request authorize
api.x.com/oauth/ 		5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Requested by
Host: abs-0.twimg.com
URL: https://abs-0.twimg.com/login/redirect_x.f20424c5b392053b4fdeb62b1a10e3bdb8ffef5b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.66 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
53e848d66c0a87baebc74cdd4c70d6e4059a1107ae4ecff159e1636a916e030c
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src https://abs.twimg.com https://abs-0.twimg.com data:; frame-src 'self' twitter:; frame-ancestors 'self' https://tweetdeck.twitter.com https://tdapi-staging.smf1.twitter.com https://tdapi-staging.atla.twitter.com https://tdapi-staging.pdxa.twitter.com https://tweetdeck.localhost.twitter.com; img-src https://abs.twimg.com https://*.twimg.com https://pbs.twimg.com data:; media-src 'none'; object-src 'none'; script-src https://abs.twimg.com https://abs-0.twimg.com https://twitter.com https://mobile.twitter.com; style-src https://abs.twimg.com https://abs-0.twimg.com; report-uri https://twitter.com/i/csp_report?a=NVQWGYLXFVWG6Z3JNY%3D%3D%3D%3D%3D%3D&ro=false;
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://api.twitter.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

att
1-a5hSQQKTyngCtCTaNUPYNoFHLFvEMkXRjp43KgBQ
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-encoding
gzip
content-length
2436
content-security-policy
default-src 'none'; connect-src 'self'; font-src https://abs.twimg.com https://abs-0.twimg.com data:; frame-src 'self' twitter:; frame-ancestors 'self' https://tweetdeck.twitter.com https://tdapi-staging.smf1.twitter.com https://tdapi-staging.atla.twitter.com https://tdapi-staging.pdxa.twitter.com https://tweetdeck.localhost.twitter.com; img-src https://abs.twimg.com https://*.twimg.com https://pbs.twimg.com data:; media-src 'none'; object-src 'none'; script-src https://abs.twimg.com https://abs-0.twimg.com https://twitter.com https://mobile.twitter.com; style-src https://abs.twimg.com https://abs-0.twimg.com; report-uri https://twitter.com/i/csp_report?a=NVQWGYLXFVWG6Z3JNY%3D%3D%3D%3D%3D%3D&ro=false;
content-type
text/html;charset=utf-8
date
Wed, 11 Dec 2024 07:11:47 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Wed, 11 Dec 2024 07:11:47 GMT
ml
A
perf
7402827104
pragma
no-cache
server
tsa_f
status
200 OK
strict-transport-security
max-age=631138519
x-connection-hash
16c7d8af012df689c9fb730c6844119e76b5d849a5a2148477acf1db0bfad038
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-response-time
261
x-transaction
1ad893187fcc78f5
x-transaction-id
1ad893187fcc78f5
x-twitter-response-tags
BouncerCompliant
x-ua-compatible
IE=edge,chrome=1
x-xss-protection
0
redirect_x.f20424c5b392053b4fdeb62b1a10e3bdb8ffef5b.js
abs-0.twimg.com/login/ 		133 B
510 B 		Script
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/login/redirect_x.f20424c5b392053b4fdeb62b1a10e3bdb8ffef5b.js
Requested by
Host: api.x.com
URL: https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9fd820eb967e100de314ee60af5c15f80aca8b4a5fcf071364f8e55618def1f8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.x.com/

Response headers

x-transaction-id
3d70bef4c8e66810
content-encoding
gzip
etag
"Eza0F9ln459i4/5txW3I4w=="
x-content-type-options
nosniff
expires
Wed, 22 Oct 2025 07:04:06 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
perf
7402827104
content-type
application/javascript
x-served-by
cache-pdk-kfty8610046-PDK, cache-fra-eddf8230110-FRA
last-modified
Tue, 22 Oct 2024 04:17:53 GMT
vary
Accept-Encoding
strict-transport-security
max-age=631138519
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
101
tfw-base.495c9dbdc09e258208496e76f51cba5524b11132.css
abs-0.twimg.com/login/ 		27 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/login/tfw-base.495c9dbdc09e258208496e76f51cba5524b11132.css
Requested by
Host: api.x.com
URL: https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
36c135afdbd31fff5d1933147d5b8c7301d37a506f9470bf2846f48aeef72afd
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.x.com/

Response headers

x-transaction-id
f3a53f65dd75f3ef
content-encoding
gzip
etag
"Sw6Vd6RouWpqNQF4V6H+gQ=="
x-content-type-options
nosniff
expires
Wed, 12 Nov 2025 12:37:50 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
perf
7402827104
content-type
text/css
x-served-by
cache-pdk-kfty8610035-PDK, cache-fra-eddf8230110-FRA
last-modified
Tue, 12 Nov 2024 08:17:43 GMT
vary
Accept-Encoding
strict-transport-security
max-age=631138519
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
6594
base.7ced3ee3ff61dadf91a9c9bd7082adc8f158a360.js
abs-0.twimg.com/login/ 		110 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/login/base.7ced3ee3ff61dadf91a9c9bd7082adc8f158a360.js
Requested by
Host: api.x.com
URL: https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1fb27eccf58679427fc8568061bb2393eb9267cb828e1ffbbd739a62029256e8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.x.com/

Response headers

x-transaction-id
815c456238fc2118
content-encoding
gzip
etag
"ni/3pFnHtfLdF8BCS5m2+Q=="
x-content-type-options
nosniff
expires
Thu, 17 Oct 2024 08:03:46 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
perf
7626143928
content-type
application/javascript
x-served-by
cache-pdk-kpdk1780034-PDK, cache-fra-eddf8230110-FRA
last-modified
Wed, 18 Oct 2023 06:18:02 GMT
vary
Accept-Encoding
strict-transport-security
max-age=631138519
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
39287
authorize_page.c4edf9ccaf94a42b6963991691957aaa827aa56b.js
abs-0.twimg.com/login/ 		2 KB
974 B 		Script
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/login/authorize_page.c4edf9ccaf94a42b6963991691957aaa827aa56b.js
Requested by
Host: api.x.com
URL: https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ad7976273a11eff451930e478ea50e830556b7fce0c33f511c829383672dfa34
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.x.com/

Response headers

x-transaction-id
5f335ccd2239d77b
content-encoding
gzip
etag
"76qrTfW/TZXmL7Vpk/RnSQ=="
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 12:50:55 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
perf
7402827104
content-type
application/javascript
x-served-by
cache-pdk-kpdk1780034-PDK, cache-fra-eddf8230110-FRA
last-modified
Wed, 06 Nov 2024 10:17:51 GMT
vary
Accept-Encoding
strict-transport-security
max-age=631138519
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
847
pjouLGED
pbs.twimg.com/app_img/1839595766710779904/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/app_img/1839595766710779904/pjouLGED?format=jpg&name=73x73
Requested by
Host: api.x.com
URL: https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.120.159 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
23cb31985ebc6acddb0164c8300cea7773c8f7004b8cedea8f49766e37a0da0a
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://api.x.com/

Response headers

x-transaction-id
0eb390b95cd6d136
access-control-expose-headers
Content-Length
cache-tag
app_img,app_img/bucket/1,app_img/1839595766710779904
x-content-type-options
nosniff
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 07:11:47 GMT
x-tw-cdn
FT
last-modified
Fri, 27 Sep 2024 09:17:43 GMT
perf
7402827104
x-served-by
cache-lhr-egll1980034-LHR, cache-fra-etou8220032-FRA, cache-tw-ZZZ1
content-type
image/jpeg
strict-transport-security
max-age=631138519
cache-control
max-age=604800, must-revalidate
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
access-control-allow-origin
*
content-length
2626
xlogo.png
abs-0.twimg.com/login/img/16/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
abs-0.twimg.com
URL
https://abs-0.twimg.com/login/img/16/xlogo.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Twitter (Social Network)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| FancyForm function| $ function| jQuery object| userAgentUtils object| $session number| ESCAPE_KEY

4 Cookies

Domain/Path Name / Value
.twitter.com/ Name: _twitter_sess
Value: BAh7CSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCA0%252Bj7STAToMY3NyZl9p%250AZCIlNjRjZGZlODEyNGMyYTNhMjE1NmI1MDhiN2FiN2EzNzY6B2lkIiUzYWEy%250ANTAxNjI4ZjJmYmFmYjU4YzI3ODkwY2VlOWEwYw%253D%253D--b57007ec9ec5ae1486447715a6181260107716cb
.twitter.com/ Name: guest_id
Value: v1%3A173390110670299986
.x.com/ Name: _twitter_sess
Value: BAh7CSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCMlAj7STAToMY3NyZl9p%250AZCIlMzI0YWQ0NWMwMDNkMWQ5ZGMxZDgxOWY0MjRjZTBjZDc6B2lkIiU3ZTJh%250AYmUwZmZiMjdjZjlmYmY5OWFlZWI0NWY3NTQ4ZQ%253D%253D--957d56f49baf6ab581014fbc0d880871049f1e9f
.x.com/ Name: guest_id
Value: v1%3A173390110740317330

2 Console Messages

Source Level URL
Text
rendering warning URL: https://api.twitter.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw(Line 6)
Message:
Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.
rendering warning URL: https://api.x.com/oauth/authorize?oauth_token=SkDuAgAAAAABwGaMAAABk7SPPFw(Line 6)
Message:
Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src https://abs.twimg.com https://abs-0.twimg.com data:; frame-src 'self' twitter:; frame-ancestors 'self' https://tweetdeck.twitter.com https://tdapi-staging.smf1.twitter.com https://tdapi-staging.atla.twitter.com https://tdapi-staging.pdxa.twitter.com https://tweetdeck.localhost.twitter.com; img-src https://abs.twimg.com https://*.twimg.com https://pbs.twimg.com data:; media-src 'none'; object-src 'none'; script-src https://abs.twimg.com https://abs-0.twimg.com https://twitter.com https://mobile.twitter.com; style-src https://abs.twimg.com https://abs-0.twimg.com; report-uri https://twitter.com/i/csp_report?a=NVQWGYLXFVWG6Z3JNY%3D%3D%3D%3D%3D%3D&ro=false;
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0