3 ms·
that's not the url though. the sub-domain in the image is "protected-users" - which makes no sense, btw.
by robswc 2y ago
that's not the url though.
the sub-domain in the image is "protected-users" - which makes no sense, btw.
- beeflourishing 2y agothe screenshot for sure is fake. But that twitter Okta subdomain (twitter.okta.com) isn't. I got redirected to some twitter.biz site when I went to the Okta URL on my phone. and then got a cloudflare message saying I got blocked. I did some more digging. there is a SOA record for twitter.biz which says noc.twitter.com is responsible for it. DATA: a.u09.twtrdns.net. noc.twitter.com. 2023050934 3600 600 604800 60 MNAME: a.u09.twtrdns.net. RNAME: noc.twitter.com. Serial: 2023050934 Refresh: 1 hour Retry: 10 minutes Expire: 7 days TTL: 1 minute
- wlonkly 2y agoSure, that means Twitter probably uses Okta for corporate SSO (as do many companies), but nothing more. Okta offers white-labeling on your own domain (and some advanced Okta features are only available via white-labeling), so twitter.biz is probably their corporate domain. (that's noc @ twitter.com, by the way, the RNAME is an email address where you replace the leftmost dot with an @.) Be careful with "that subdomain", though -- beeflourishing.okta.com also resolves, they've probably got a wildcard DNS entry and definitely have a wildcard SSL cert there. None of that is evidence of this thing.