urlscan.io logo urlscan.io
SecurityTrails logo

twitter.com Open in urlscan Pro
162.159.140.229  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.co/ki9bLR54Bb
Effective URL: https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI
Submission: On September 15 via api from BE — Scanned from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 162.159.140.229, located in Ascension Island and belongs to CLOUDFLARENET, US. The main domain is twitter.com. The Cisco Umbrella rank of the primary domain is 523.
TLS certificate: Issued by E6 on August 19th 2025. Valid for: 3 months.
This is the only time twitter.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 162.159.140.229 13335 (CLOUDFLAR...)
2 104.244.43.131 54113 (FASTLY)
1 146.75.116.159 54113 (FASTLY)
4 3
Apex Domain
Subdomains		 Transfer
3 twimg.com
abs-0.twimg.com — Cisco Umbrella Rank: 4139
abs.twimg.com — Cisco Umbrella Rank: 3916
41 KB
1 twitter.com
twitter.com — Cisco Umbrella Rank: 523
5 KB
1 t.co
t.co — Cisco Umbrella Rank: 992
593 B
4 3
Domain Requested by
2 abs-0.twimg.com twitter.com
1 abs.twimg.com
1 twitter.com
1 t.co 1 redirects
4 4

This site contains links to these domains. Also see Links.

Domain
help.x.com
k4w7hpwl.berneer.sbs
Subject Issuer Validity Valid
twitter.com
E6		 2025-08-19 -
2025-11-17		 3 months crt.sh
*.twimg.com
R10		 2025-08-06 -
2025-11-04		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI
Frame ID: C6EE4DDD299130423C6CAFC06D31CC67
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://t.co/ki9bLR54Bb HTTP 302
    https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

3
Countries

47 kB
Transfer

129 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/ki9bLR54Bb HTTP 302
    https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request unsafe_link_warning
twitter.com/safety/
Redirect Chain
  • https://t.co/ki9bLR54Bb
  • https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI
12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.140.229 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad8dd34ac1dee1f132a3d1b3a065e3c50138fd26dace75e29fa342b1817fa5d7
Security Headers
Name Value
Content-Security-Policy script-src https://twitter.com 'nonce-Ie0rNItzIFieBsFVDVYnAw==' https://*.twimg.com https://iframe.arkoselabs.com/ https://ton.twitter.com https://www.recaptcha.net/recaptcha/ https://www.google.com/recaptcha/ https://client-api.arkoselabs.com/ https://www.gstatic.com/recaptcha/ 'self'; frame-ancestors https://localhost.twitter.com:3443 https://td.x.com https://tweetdeck-devel.atla.twitter.com https://tweetdeck-devel.smf1.twitter.com https://td.twitter.com https://mobile.x.com https://tdapi-staging.smf1.twitter.com https://pro.twitter.com https://pro.x.com https://tweetdeck.localhost.twitter.com https://tweetdeck.twitter.com https://mobile.twitter.com https://tdapi-staging.atla.twitter.com https://localhost.x.com:3443 'self'; font-src https://twitter.com https://*.twimg.com data: https://ton.twitter.com 'self'; media-src https://twitter.com https://*.twimg.com https://ton.twitter.com blob: 'self'; connect-src 'self' blob: https://twitter.com/ https://x.com; style-src https://twitter.com https://*.twimg.com https://ton.twitter.com 'unsafe-inline' 'self'; object-src 'none'; default-src 'self'; frame-src https://twitter.com https://*.twimg.com https://iframe.arkoselabs.com/ https://ton.twitter.com https://www.recaptcha.net/recaptcha/ https://www.google.com/recaptcha/ https://client-api.arkoselabs.com/ 'self'; img-src https://twitter.com https://*.twimg.com data: https://ton.twitter.com blob: 'self'; report-uri https://twitter.com/i/csp_report?a=ONYGC3LBMNQXO%3D%3D%3D&ro=false;
Strict-Transport-Security max-age=631138519; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36

Response headers

cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
cf-cache-status
DYNAMIC
cf-ray
97fb4acbaf53c231-TLV
content-encoding
gzip
content-security-policy
script-src https://twitter.com 'nonce-Ie0rNItzIFieBsFVDVYnAw==' https://*.twimg.com https://iframe.arkoselabs.com/ https://ton.twitter.com https://www.recaptcha.net/recaptcha/ https://www.google.com/recaptcha/ https://client-api.arkoselabs.com/ https://www.gstatic.com/recaptcha/ 'self'; frame-ancestors https://localhost.twitter.com:3443 https://td.x.com https://tweetdeck-devel.atla.twitter.com https://tweetdeck-devel.smf1.twitter.com https://td.twitter.com https://mobile.x.com https://tdapi-staging.smf1.twitter.com https://pro.twitter.com https://pro.x.com https://tweetdeck.localhost.twitter.com https://tweetdeck.twitter.com https://mobile.twitter.com https://tdapi-staging.atla.twitter.com https://localhost.x.com:3443 'self'; font-src https://twitter.com https://*.twimg.com data: https://ton.twitter.com 'self'; media-src https://twitter.com https://*.twimg.com https://ton.twitter.com blob: 'self'; connect-src 'self' blob: https://twitter.com/ https://x.com; style-src https://twitter.com https://*.twimg.com https://ton.twitter.com 'unsafe-inline' 'self'; object-src 'none'; default-src 'self'; frame-src https://twitter.com https://*.twimg.com https://iframe.arkoselabs.com/ https://ton.twitter.com https://www.recaptcha.net/recaptcha/ https://www.google.com/recaptcha/ https://client-api.arkoselabs.com/ 'self'; img-src https://twitter.com https://*.twimg.com data: https://ton.twitter.com blob: 'self'; report-uri https://twitter.com/i/csp_report?a=ONYGC3LBMNQXO%3D%3D%3D&ro=false;
content-type
text/html;charset=utf-8
date
Mon, 15 Sep 2025 21:42:08 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Mon, 15 Sep 2025 21:42:08 GMT
origin-cf-ray
97fb4acbc79bc231-ATL
perf
7402827104
pragma
no-cache
server
cloudflare
status
200 OK
strict-transport-security
max-age=631138519; includeSubdomains
vary
accept-encoding
x-connection-hash
8dd0091bfb9d62d1fe3e129c85263b02d863817269bb366ddce80c17e70424bb
x-content-type-options
nosniff
x-frame-options
DENY
x-response-time
11
x-transaction
6466eef895ac7dc4
x-transaction-id
6466eef895ac7dc4
x-twitter-response-tags
BouncerCompliant
x-xss-protection
0

Redirect headers

cache-control
no-cache,no-store,must-revalidate
cf-cache-status
DYNAMIC
cf-ray
97fb4ac92c697d94-TLV
content-length
0
date
Mon, 15 Sep 2025 21:42:07 GMT
location
https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI
origin-cf-ray
97fb4ac9353b7d94-TLV
perf
7402827104
server
cloudflare
strict-transport-security
max-age=631138519; includeSubdomains
vary
Origin, Accept-Encoding
x-connection-hash
721812708d1cbe8c91d511aa441ecb852f8e003a595fecee932ff8970b62733b
x-response-time
17
x-transaction-id
208fda656843e173
unsafe_link_warning.rtl.28fb436b026262c9cdd983689f61e6d2ee652e19.css
abs-0.twimg.com/safety/ 		10 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/safety/unsafe_link_warning.rtl.28fb436b026262c9cdd983689f61e6d2ee652e19.css
Requested by
Host: twitter.com
URL: https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e6dcae686a67bc123b848ac848f6c8236d7a4fb8a80193496693ff59a8bd6a04
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer
https://twitter.com/

Response headers

x-transaction-id
1193b5a77259e007
content-encoding
gzip
etag
"PoLHpqRtvt39GAAZjWxn2w=="
cache-tag
twitter-assets,twitter-assets/bucket/1
x-content-type-options
nosniff
expires
Tue, 18 Aug 2026 13:52:52 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Mon, 15 Sep 2025 21:42:08 GMT
x-tw-cdn
FT
last-modified
Fri, 15 Aug 2025 16:06:17 GMT
perf
7402827104
x-served-by
cache-pdk-kpdk1780033-PDK, cache-mrs10549-MRS
content-type
text/css
vary
Accept-Encoding
strict-transport-security
max-age=300
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
2948
unsafe_link_warning.82053e6d499210e7e856ada68bd7c54394647b00.js
abs-0.twimg.com/safety/ 		106 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://abs-0.twimg.com/safety/unsafe_link_warning.82053e6d499210e7e856ada68bd7c54394647b00.js
Requested by
Host: twitter.com
URL: https://twitter.com/safety/unsafe_link_warning?unsafe_link=http://k4w7hpwl.berneer.sbs/RiOwI
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8dee276c4faf404d39b1abd4691a566840d5d6c9069ac8f733513bc701e4f122
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer
https://twitter.com/

Response headers

x-transaction-id
dcc45846b283cdfe
content-encoding
gzip
etag
"Q6OoTapdhUAlRxpAoJFgLA=="
cache-tag
twitter-assets,twitter-assets/bucket/0
x-content-type-options
nosniff
expires
Thu, 20 Aug 2026 12:58:40 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Mon, 15 Sep 2025 21:42:08 GMT
x-tw-cdn
FT
last-modified
Tue, 19 Aug 2025 16:13:07 GMT
perf
7402827104
x-served-by
cache-pdk-kpdk1780099-PDK, cache-mrs10549-MRS
content-type
application/javascript
vary
Accept-Encoding
strict-transport-security
max-age=300
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
37806
twitter.3.ico
abs.twimg.com/favicons/ 		549 B
972 B 		Other
General
Check archive.org
Download Go to
Full URL
https://abs.twimg.com/favicons/twitter.3.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.159 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cc4939af5d16855f2bea8322dbf33461ebc6bfd092fa3e2291d87d3d83ebd8ed
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer
https://twitter.com/

Response headers

x-transaction-id
1bb0529ac6132839
content-encoding
gzip
etag
"nZmiNyu9WyjvSy6uysjIBQ=="
x-content-type-options
nosniff
expires
Thu, 08 Aug 2024 07:12:27 GMT
server-timing
x-cache;desc=HIT, x-tw-cdn;desc=FT
x-cache
HIT, HIT
date
Mon, 15 Sep 2025 21:42:08 GMT
x-tw-cdn
FT
perf
7626143928
content-type
image/vnd.microsoft.icon
x-served-by
cache-fty21341-FTY, cache-fra-eddf8230134-FRA
last-modified
Mon, 24 Jul 2023 17:39:19 GMT
vary
Accept-Encoding
strict-transport-security
max-age=300
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
accept-ranges
bytes
content-length
572

Verdicts & Comments Add Verdict or Comment

2 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

7 Cookies

Domain/Path Name / Value
.t.co/ Name: __cf_bm
Value: 4mo0.ZLmKKtmXFR_lrEiFmaM9LuenPA0n0Vf3P3ce4I-1757972527-1.0.1.1-q2.vG6LOKvTHRw7a9k1nyoWvAvdltJPcifh9UlszBV7pORRzkVXyUKa88cJA3Mi9QGDAQMN4AGzF30RZWKUYBWYNmiCEEUnXTCk_7UFDgKU
.twitter.com/ Name: guest_id_marketing
Value: v1%3A175797252804264173
.twitter.com/ Name: guest_id_ads
Value: v1%3A175797252804264173
.twitter.com/ Name: _twitter_sess
Value: BAh7CSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCKz7U0%252BZAToMY3NyZl9p%250AZCIlN2RhNjIyNGE1YmE2NDJiZGI3OTkyZGU2Mjc0MDQ3MGI6B2lkIiViNjEz%250AODc3NmM5ZDkxNWIzNDBlZTNjZDNkZWI2NWNmMw%253D%253D--41138db83358c3a4e4ba6ebd10f70213f6841450
.twitter.com/ Name: personalization_id
Value: "v1_DgPQEUTSIn+GzExWbNm8IA=="
.twitter.com/ Name: guest_id
Value: v1%3A175797252804264173
.twitter.com/ Name: __cf_bm
Value: Wma3RF58cLaLZUwDjJtMK4AQjdMcaU2qMblnC43.QGI-1757972528-1.0.1.1-fpyOsDLlkdLIjrRN5ZTkWEsT1QBZd4l1xFU3prf74FE6Kd2Ji9rbILc5pM_LjUaRbIIj6rFIwK_wE7lVm_72va5Slw7ZK54nVT4hmbzfejs

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src https://twitter.com 'nonce-Ie0rNItzIFieBsFVDVYnAw==' https://*.twimg.com https://iframe.arkoselabs.com/ https://ton.twitter.com https://www.recaptcha.net/recaptcha/ https://www.google.com/recaptcha/ https://client-api.arkoselabs.com/ https://www.gstatic.com/recaptcha/ 'self'; frame-ancestors https://localhost.twitter.com:3443 https://td.x.com https://tweetdeck-devel.atla.twitter.com https://tweetdeck-devel.smf1.twitter.com https://td.twitter.com https://mobile.x.com https://tdapi-staging.smf1.twitter.com https://pro.twitter.com https://pro.x.com https://tweetdeck.localhost.twitter.com https://tweetdeck.twitter.com https://mobile.twitter.com https://tdapi-staging.atla.twitter.com https://localhost.x.com:3443 'self'; font-src https://twitter.com https://*.twimg.com data: https://ton.twitter.com 'self'; media-src https://twitter.com https://*.twimg.com https://ton.twitter.com blob: 'self'; connect-src 'self' blob: https://twitter.com/ https://x.com; style-src https://twitter.com https://*.twimg.com https://ton.twitter.com 'unsafe-inline' 'self'; object-src 'none'; default-src 'self'; frame-src https://twitter.com https://*.twimg.com https://iframe.arkoselabs.com/ https://ton.twitter.com https://www.recaptcha.net/recaptcha/ https://www.google.com/recaptcha/ https://client-api.arkoselabs.com/ 'self'; img-src https://twitter.com https://*.twimg.com data: https://ton.twitter.com blob: 'self'; report-uri https://twitter.com/i/csp_report?a=ONYGC3LBMNQXO%3D%3D%3D&ro=false;
Strict-Transport-Security max-age=631138519; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0