Scan report · 3 months agoPublic

x.com

172.66.0.227AS13335 · US

Verdict

0 of 7 enginesCleanAutomated

Looks safe

Automated

It asks you to enter a password. Our automated checks did not find known threat signals on this site at the time of the scan.

What to do

No action needed. Stay alert as usual — a clean result reflects this scan only, and sites can change after they are checked.

A clean result means no known threat signals were found in this scan — it is not an absolute guarantee, and a site can change after it is checked.

Findings

Strongest first

InfoBrand impersonation detected

Google · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

InfoCross-domain scripts injected at runtime

50 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-2561f52908e7f36914ed6e455fc69d6423f7baa64613d19059e9b9d20d8bcd06915

Infrastructure

IP: 172.66.0.227CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=E7, O=Let's Encrypt, C=US · expires Aug 26, 2026

WHOIS

Registrar: GoDaddy.com, LLC
Created: Apr 2, 1993
Expires: Oct 20, 2034
Nameservers: a.r10.twtrdns.neta.u10.twtrdns.netb.r10.twtrdns.netb.u10.twtrdns.netc.r10.twtrdns.netc.u10.twtrdns.netd.r10.twtrdns.netd.u10.twtrdns.net

7 malicious1 suspicious

Hashes & fingerprints

Page Hash82b02e5b1b6cc0137c622282cb8c5d27933f2d029a0369922e09d40a829f4ebd Favicon Hashcc4939af5d16855f2bea8322dbf33461ebc6bfd092fa3e2291d87d3d83ebd8ed DOM Hashb784a77944aebdbd345e2bb189ad91a6edd0cee783c91d839a79dfe92c14127d Screenshot pHashbc983837c3668fe0 JARM27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintF972261D1294DEA051598D13A38F93FF177490DD Cert IssuerCN=E7, O=Let's Encrypt, C=US

Page capture

Live

Title “X. It’s what’s happening / X” · brand shown: Google (low)

Visit Site

Engines

7 · time to verdict