Tweet by grinich
July 5, 2025
@irvinebroque @X Great question! The malicious link resolves to a redirection server that checks the user agent. If it’s “Twitterbot” (used for creating previews) it will redirect to Google Calendar. See screenshot. But when it’s your real browser, it will redirect to the attack URL. Sneaky! https://t.co/PUuHdxfJX3
- Author
- grinich
- Date
- July 5, 2025
- Canonical URL
- /tweets/grinich-1941605281873658282-196281