4 ms·

twitter.okta.com cert: openssl s_client -connect twitter.okta.com:443 CONNECTED(00000006) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCer

twitter.okta.com cert: openssl s_client -connect twitter.okta.com:443 CONNECTED(00000006) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify return:1 depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 verify return:1 depth=0 C = US, ST = California, L = San Francisco, O = "Okta, Inc.", CN = .okta.com verify return:1 write W BLOCK --- Certificate chain 0 s:/C=US/ST=California/L=San Francisco/O=Okta, Inc./CN=.okta.com i:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1 1 s:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1 i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA ---

robswc 2y ago
that's not the url though. the sub-domain in the image is "protected-users" - which makes no sense, btw.
- beeflourishing 2y ago
  the screenshot for sure is fake. But that twitter Okta subdomain (twitter.okta.com) isn't. I got redirected to some twitter.biz site when I went to the Okta URL on my phone. and then got a cloudflare message saying I got blocked. I did some more digging. there is a SOA record for twitter.biz which says noc.twitter.com is responsible for it. DATA: a.u09.twtrdns.net. noc.twitter.com. 2023050934 3600 600 604800 60 MNAME: a.u09.twtrdns.net. RNAME: noc.twitter.com. Serial: 2023050934 Refresh: 1 hour Retry: 10 minutes Expire: 7 days TTL: 1 minute
  - wlonkly 2y ago
    Sure, that means Twitter probably uses Okta for corporate SSO (as do many companies), but nothing more. Okta offers white-labeling on your own domain (and some advanced Okta features are only available via white-labeling), so twitter.biz is probably their corporate domain. (that's noc @ twitter.com, by the way, the RNAME is an email address where you replace the leftmost dot with an @.) Be careful with "that subdomain", though -- beeflourishing.okta.com also resolves, they've probably got a wildcard DNS entry and definitely have a wildcard SSL cert there. None of that is evidence of this thing.

robswc 2y ago

that's not the url though. the sub-domain in the image is "protected-users" - which makes no sense, btw.

beeflourishing 2y ago
the screenshot for sure is fake. But that twitter Okta subdomain (twitter.okta.com) isn't. I got redirected to some twitter.biz site when I went to the Okta URL on my phone. and then got a cloudflare message saying I got blocked. I did some more digging. there is a SOA record for twitter.biz which says noc.twitter.com is responsible for it. DATA: a.u09.twtrdns.net. noc.twitter.com. 2023050934 3600 600 604800 60 MNAME: a.u09.twtrdns.net. RNAME: noc.twitter.com. Serial: 2023050934 Refresh: 1 hour Retry: 10 minutes Expire: 7 days TTL: 1 minute
- wlonkly 2y ago
  Sure, that means Twitter probably uses Okta for corporate SSO (as do many companies), but nothing more. Okta offers white-labeling on your own domain (and some advanced Okta features are only available via white-labeling), so twitter.biz is probably their corporate domain. (that's noc @ twitter.com, by the way, the RNAME is an email address where you replace the leftmost dot with an @.) Be careful with "that subdomain", though -- beeflourishing.okta.com also resolves, they've probably got a wildcard DNS entry and definitely have a wildcard SSL cert there. None of that is evidence of this thing.