https://x.com/infodinero
162.159.140.229 · Cloudflare, Inc.
Toronto, Canada
12060 days
200 · 28.0s
Valid· E8, Let's Encrypt, US
COMPLETED
No KB/IOK detections were recorded for this scan.
Technology · 4/15/2026
The page at x.com/infodinero presents UI elements and network activity that mimic X/Twitter branding and structure, including a profile header for 'Andrew Hensen' and a banner-style UI. However, the URL is under x.com, which is the official domain for X; the displayed content appears to be a profile page rather than a credential collection form. The evidence includes off-domain API submission endpoints (e.g., https://appleid.cdn-apple.com/... and interactions with https://api.x.com/1.1/graphql/user_flow.json) and an SPA-style rendering with dynamic scripts, but there is no static login form in the initial HTML, and no explicit credential capture form identified in the static source. The risk indicators (typosquat warning in the score, iframe presence, off-domain endpoints) exist but the page visually aligns with X’s brand and domain ownership via x.com, making impersonation claims uncertain without more definitive credential-phishing signals on the rendered content. The presence of dynamic credential-like flows on an official domain could indicate abuse if credential theft is active, but current static analysis does not confirm a phishing UI on this domain.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 118
Hosts: 7
Domains: 5
Suspicious Endpoints
hxxps://appleid[.]cdn-apple[.]com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js
Off-Domain Posts
hxxps://appleid[.]cdn-apple[.]com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js
The scan shows an official-domain X page rendering a user profile with a modern SPA approach and signs of credential-related flows (GraphQL user_flow, onboarding sso_init) on the official domain. While there is an iframe pointing to Google Sign-In and a reference to Apple authentication, these elements are commonly used on legitimate sign-in or onboarding experiences. The presence of off-domain scripts and dynamic content warrants caution, as it could reflect legitimate third-party authentication flows or potential abuse on the surface of a first-party site. No definitive credential-harvesting UI is confirmed in the static HTML, but the combination of dynamic forms and external auth scripts means monitoring is advisable. The page appears to be first-party branding rather than impersonation, but the risk score and off-domain calls justify ongoing observation for potential abuse.
Monitor