security-twitter.com

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3034::ac43:b2c8, located in United States and belongs to CLOUDFLARENET, US. The main domain is security-twitter.com.
TLS certificate: Issued by GTS CA 1P5 on March 10th 2023. Valid for: 3 months.

This is the only time security-twitter.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Twitter (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2606:4700:303... 2606:4700:3034::ac43:b2c8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (STACKPATH...) (STACKPATH-CDN)
1	2606:4700:303... 2606:4700:3038::6815:ea18	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:6ea0:c70... 2a02:6ea0:c700::19	60068 (CDN77 ^_^) (CDN77 ^_^)
5	4

3 2606:4700:3034::ac43:b2c8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

security-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3038::6815:ea18 (United States)

ASN13335 (CLOUDFLARENET, US)

i.hizliresim.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::19 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

img.icons8.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	security-twitter.com 1 redirects security-twitter.com	5 KB
1	icons8.com img.icons8.com — Cisco Umbrella Rank: 31626	1 KB
1	hizliresim.com i.hizliresim.com — Cisco Umbrella Rank: 132002	94 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 686	30 KB
5	4

	Domain	Requested by
3	security-twitter.com	1 redirects security-twitter.com
1	img.icons8.com	security-twitter.com
1	i.hizliresim.com	security-twitter.com
1	code.jquery.com	security-twitter.com
5	4

This site contains no links.

Subject Issuer	Validity	Valid
*.security-twitter.com GTS CA 1P5	`2023-03-10` - `2023-06-08`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
*.hizliresim.com E1	`2023-01-25` - `2023-04-25`	3 months	crt.sh
1004834818.rsc.cdn77.org R3	`2023-02-18` - `2023-05-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://security-twitter.com/policy/
Frame ID: A25E941A94060FDECB3CF5048D8D3F56
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Twitter

Page URL History Show full URLs

http://security-twitter.com/policy/ HTTP 301
https://security-twitter.com/policy/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

130 kB
Transfer

195 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://security-twitter.com/policy/ HTTP 301
https://security-twitter.com/policy/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
security-twitter.com/policy/
Redirect Chain

http://security-twitter.com/policy/
https://security-twitter.com/policy/

10 KB
3 KB

162ms
126ms

Document
text/html

2606:4700:3034::ac43:b2c8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://security-twitter.com/policy/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b2c8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd32b173a1d950fd090e37dd82d2017d61590c38c46aca2e18dbee4f7264555e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7aa91cc5fcb7bb3b-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 19 Mar 2023 22:22:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XZApIkkYb5AOwnAZGDCH%2FKxvBBDGAOQ95MKaMTA6UL6b3%2B27FiSCNySjs8BtEvTwfICNvi97PwfqiMZNv4Kle9T%2BTdCgz2nazKnkkvpAi%2F4x2Qchs6y3XSvBWwq7NKOxnEprXMyLg4t9hqBp5uD%2B5QF5lw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

CF-RAY: 7aa91cc57cd2161d-DUS
Cache-Control: max-age=3600
Connection: keep-alive
Date: Sun, 19 Mar 2023 22:22:08 GMT
Expires: Sun, 19 Mar 2023 23:22:08 GMT
Location: https://security-twitter.com/policy/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wnfj%2FSSgr2fANA60Rh1uwIuvpT6iLhgxckJtGmTNFzEnTJ4Zi%2FJ074zPXZ%2FKgpYixG5mhq7D9MPCUoyyHzFgFgYrwaGaCpJXH0xzcOpDppKMOC2WK2ypK10GsHXNbZYx7WdmarBNtyHy5NAN6oCnkSM4kA%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery-3.6.1.min.js Show response
code.jquery.com/ 88 KB
30 KB 84ms
18ms Script
application/javascript 2001:4de0:ac18::1:a:1b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.1.min.js
Requested by: Host: security-twitter.com
URL: https://security-twitter.com/policy/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Request headers

Referer: https://security-twitter.com/
Origin: https://security-twitter.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Sun, 19 Mar 2023 22:22:08 GMT
content-encoding: gzip
last-modified: Fri, 26 Aug 2022 17:36:05 GMT
server: nginx
etag: W/"63090485-15e40"
vary: Accept-Encoding
x-hw: 1679264528.dop153.am5.t,1679264528.cds008.am5.hn,1679264528.cds012.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30957

GET
H2 200 gg.css
security-twitter.com/policy/ 3 KB
1 KB 99ms
98ms Stylesheet
text/css 2606:4700:3034::ac43:b2c8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://security-twitter.com/policy/gg.css?version=65989209
Requested by: Host: security-twitter.com
URL: https://security-twitter.com/policy/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:b2c8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d014b401ae5fa48e1af22ad9dd21e299eb1266f78d69b08a176fc920b4275ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://security-twitter.com/policy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Sun, 19 Mar 2023 22:22:08 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 16 Mar 2023 19:48:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=egqJJ%2FDGEc7u%2FgMYFzJU3b6WUMTwJIpQGIv5rvl1pgtVSVDqUt%2BBfVGwP0Tl%2B5swPbp69m7SxJml6V7U0dTnLcoZa%2FqEoes1e1rKwWa5smz1F2aEqNvPAK5njJDz2xW8eekyDqs6l3zUXGbQHFtT26KNaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 7aa91cc6dd8dbb3b-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sun, 26 Mar 2023 22:22:08 GMT

GET
H2 200 br1cqaz.png
i.hizliresim.com/ 93 KB
94 KB 79ms
36ms Image
image/jpeg 2606:4700:3038::6815:ea18
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.hizliresim.com/br1cqaz.png
Requested by: Host: security-twitter.com
URL: https://security-twitter.com/policy/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ea18 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c98606a1c0ba0b0586b8fbde7cdab85abdcac296053d87ede98ff6f57bde09d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://security-twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Sun, 19 Mar 2023 22:22:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: BFFF269CBD4D1DF3
age: 27356
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: GyCSI/OUEOl28jN6daU0RAd77pOxk3/v2HCRa2HR5Yqh1l3fgBIrPTHn1rCB5oTW0YC7JzBvub59
last-modified: Mon, 24 Oct 2022 17:33:21 GMT
server: cloudflare
etag: W/"48a43c7c1a4cc67aa70e4c63dfc715b1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nSIKqVOSVeDqag96to7K6OD2%2FC4tOdmxPK2JuDGS%2BS80XXYV7l%2FaZbbg54Oic9YbyIkJyd71%2B2puLGP7dPHZV2R%2FQCsSSb0JdavVe3caYHrDpSYgkp3%2BWHHhx3aBlA8ul8QPg6L2j5tCpFBvxiVl"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=604800
cf-ray: 7aa91cc7cefd216f-DUS
expires: Mon, 20 Mar 2023 09:46:52 GMT

GET
H2 200 external-Menu-glyph-others-inmotus-design.png
img.icons8.com/external-others-inmotus-design/344/ 983 B
1 KB 375ms
298ms Image
image/png 2a02:6ea0:c700::19
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.icons8.com/external-others-inmotus-design/344/external-Menu-glyph-others-inmotus-design.png

Requested by

Host: security-twitter.com
URL: https://security-twitter.com/policy/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6ea0:c700::19 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

CDN77-Turbo /

Resource Hash

8f522579507cdb10808713e260d4b2ef979255204103b5dcb6bc5570ef70a7ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://security-twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Sun, 19 Mar 2023 22:22:08 GMT
strict-transport-security: max-age=15724800; includeSubDomains
version: 0.0.29
icon-format: png
x-cache: MISS
x-77-cache: MISS
content-length: 983
x-77-nzt: AcO1qhEj09Sh
not-found-platform: false
icon-size: 344
last-modified: Sun, 19 Feb 2023 11:28:17
from-mongo-cache: false
server: CDN77-Turbo
x-77-nzt-ray: 4c15622420a1f76f108b176450086f26
vary: Origin
from-redis-cache: true
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=302400
accept-ranges: bytes
icon-id: y7x3TwX6bdjw

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Twitter (Social Network)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
i.hizliresim.com
img.icons8.com
security-twitter.com
2001:4de0:ac18::1:a:1b
2606:4700:3034::ac43:b2c8
2606:4700:3038::6815:ea18
2a02:6ea0:c700::19
1c98606a1c0ba0b0586b8fbde7cdab85abdcac296053d87ede98ff6f57bde09d
3d014b401ae5fa48e1af22ad9dd21e299eb1266f78d69b08a176fc920b4275ec
8f522579507cdb10808713e260d4b2ef979255204103b5dcb6bc5570ef70a7ff
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
bd32b173a1d950fd090e37dd82d2017d61590c38c46aca2e18dbee4f7264555e

security-twitter.com Open in urlscan Pro 2606:4700:3034::ac43:b2c8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

130 kBTransfer

195 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

0 Cookies

Indicators

security-twitter.com Open in urlscan Pro
2606:4700:3034::ac43:b2c8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

130 kB
Transfer

195 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!