4 ms·
the screenshot for sure is fake. But that twitter Okta subdomain (twitter.okta.com) isn't. I got redirected to some twitter.biz site when I went to the Okta URL
by beeflourishing 2y ago
the screenshot for sure is fake. But that twitter Okta subdomain (twitter.okta.com) isn't. I got redirected to some twitter.biz site when I went to the Okta URL on my phone. and then got a cloudflare message saying I got blocked.
I did some more digging. there is a SOA record for twitter.biz which says noc.twitter.com is responsible for it.
DATA: a.u09.twtrdns.net. noc.twitter.com. 2023050934 3600 600 604800 60
MNAME: a.u09.twtrdns.net.
RNAME: noc.twitter.com.
Serial: 2023050934
Refresh: 1 hour
Retry: 10 minutes
Expire: 7 days
TTL: 1 minute
- wlonkly 2y agoSure, that means Twitter probably uses Okta for corporate SSO (as do many companies), but nothing more. Okta offers white-labeling on your own domain (and some advanced Okta features are only available via white-labeling), so twitter.biz is probably their corporate domain. (that's noc @ twitter.com, by the way, the RNAME is an email address where you replace the leftmost dot with an @.) Be careful with "that subdomain", though -- beeflourishing.okta.com also resolves, they've probably got a wildcard DNS entry and definitely have a wildcard SSL cert there. None of that is evidence of this thing.