twitter-authx[.]com

Analysis of twitter-authx.com shows that the domain was registered through HOSTINGER operations, UAB and created on 21 October 2025. The authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com, which resolve the domain to the IPv4 address 91.98.42.129. The IP belongs to the Hetzner Online GmbH network (AS24940) and is geolocated in Germany. No TLS certificate is presented, indicating that the site does not serve content over HTTPS.

The page title returned when the site was reachable was “Login - Twitter Manager”, directly referencing the Twitter brand. The scam type is identified as brand impersonation, targeting Twitter users. VirusTotal scans have recorded three detections out of ninety‑five submitted security vendors, and the domain is listed on a single external blocklist. Gridinsoft assigned a trust score of zero out of one hundred, and the domain is currently blocked by the PhishDestroy service.

The site has been taken offline, and its current HTTP status is unavailable. The observable evidence confirms a deliberate attempt to lure victims into providing credentials for the Twitter service, but the lack of an active HTTPS endpoint limits the ability to capture traffic at this time. Defenders should continue to monitor the IP address 91.98.42.129 for any re‑activation, enforce blocklist updates that include this host, and consider adding the domain to internal URL filtering policies. Further investigation is required to determine whether additional infrastructure such as command‑and‑control servers or credential‑harvesting back‑ends is associated with the same IP range, as the present data set does not reveal such components.