The XSS Rat - Proud XSS N00b :-) engagement report
@theXSSrat - 170K followers on X
Measured over 39 original posts from a 30-day window, last computed on October 22, 2026.
Engagement
A typical post picks up 11 interactions against 170K followers, an engagement rate of 0.006%. Measured over 39 original posts, its engagement rate beats 19% of 20,444 tracked accounts of a similar size. That is a reason to look at how the audience behaves - reply depth, saves, whether the followers are recent - rather than a conclusion about it on its own. Posts are seen about 2.0K times each, and 0.539% of those impressions turn into an interaction. That is about 1.20% of the follower count, which is the gap between an audience on paper and an audience in a timeline. Posting runs at about 2 posts a day over the last 30 days, though only 10% of days saw any activity at all. Most posts go out around 08:00 UTC, and Monday is the busiest day of the week. Of the 39 posts sampled, 38% carry an image or video and 77% link out. The account's strongest tracked post pulled 775 interactions, about 70x its own typical post. Recurring topics include #bugbounty, #infosec, #ai.
Measured over 39 original posts from a 30-day window, last computed on October 22, 2026. Recurring tags: #bugbounty, #infosec, #ai.
Compared with accounts its own size
The XSS Rat - Proud XSS N00b :-)'s engagement rate beats 19% of the tracked X accounts closest to it in follower count (20,444 accounts, accounts of similar size (decile 9 of 10)). A percentile is spread evenly by construction, so 50 really is the middle of that group and 90 really is its top tenth.
On engagement per impression rather than per follower it beats 28% of the same group. When those two numbers disagree, the gap is about how far its posts travel rather than how people react to them.
Where this sits in the catalog
At 0.006%, The XSS Rat - Proud XSS N00b :-) sits above the 10th percentile of the 205,475 accounts in this comparison. That places it in the bottom 25% band, which runs below 0.024%.
Show the percentile table
| Percentile | Engagement rate |
|---|---|
| 10th percentile | 0.004% |
| 25th percentile | 0.024% |
| 50th percentile | 0.143% |
| 75th percentile | 0.678% |
| 90th percentile | 2.55% |
| 99th percentile | 82.4% |
This ruler is the whole measured catalog, not a size-matched group: it shows where the raw rate falls across every account we can measure, all of which are large. For a like-for-like comparison, read the size-band percentile above instead. See how the bands are built
Posting timing
This account posts most often around 08:00 UTC, and Monday is its busiest day of the week. The bars below are the catalog-wide pattern, with this account's own busiest slot marked. They do not show how this account performs at each hour: we keep one aggregate per account, not one per hour, so that measurement does not exist in our data.
Show engagement by hour posted, utc as a table
| Hour (UTC) | Vs author median | Posts |
|---|---|---|
| 00:00 UTC | -1% | 89K |
| 01:00 UTC | -2% | 90K |
| 02:00 UTC | -3% | 88K |
| 03:00 UTC | -4% | 94K |
| 04:00 UTC | -5% | 76K |
| 05:00 UTC | -4% | 75K |
| 06:00 UTC | -5% | 86K |
| 07:00 UTC | -5% | 93K |
| 08:00 UTC | -4% | 108K |
| 09:00 UTC | -4% | 124K |
| 10:00 UTC | -3% | 129K |
| 11:00 UTC | -3% | 141K |
| 12:00 UTC | -3% | 154K |
| 13:00 UTC | -3% | 167K |
| 14:00 UTC | -4% | 173K |
| 15:00 UTC | -2% | 176K |
| 16:00 UTC | -3% | 171K |
| 17:00 UTC | -3% | 159K |
| 18:00 UTC | -2% | 149K |
| 19:00 UTC | -2% | 141K |
| 20:00 UTC | -1% | 131K |
| 21:00 UTC | 0% | 116K |
| 22:00 UTC | -2% | 100K |
| 23:00 UTC | -1% | 90K |
Show engagement by day of week as a table
| Day | Vs author median | Posts |
|---|---|---|
| Sunday | +5% | 393K |
| Monday | +1% | 483K |
| Tuesday | -2% | 520K |
| Wednesday | -3% | 472K |
| Thursday | -2% | 430K |
| Friday | -3% | 447K |
| Saturday | +2% | 393K |
Formats this account uses
Its own posting mix on the left, and what each of those formats does across every account we track on the right. Only formats where the effect clears our publish test appear here, so an empty row is a format we could not measure rather than one that does nothing.
| Format | This account | Catalog effect | 95% interval | Accounts behind it |
|---|---|---|---|---|
| Image or video | 38% of posts | +111% | +108% to +115% | 34K |
| Outbound link | 77% of posts | -41% | -42% to -40% | 32K |
| Typical length | - | +15% | +14% to +16% | 32K |
- 38% of this account's sampled posts carry an image or video. Across the catalog, posts with an image or video run 111% above the same accounts' other posts.
- 77% of its posts carry a link off X. Across the catalog, posts with an outbound link run 41% below the same accounts' other posts, so a large share of this account's output sits in the weakest bucket we measure.
- Its average post runs 392 characters, which falls in the over 280 characters band. Across the catalog, posts over 280 characters run 15% above the same accounts' other posts.
These are catalog-wide differences applied to this account's own posting mix, not a measurement of how each format performs for this account specifically. We keep one median per account, not one per format per account, so the second thing is not something this data can tell you.
Best tweets
- Oct 19, 202670x their median
THIS IS F**KING INSANE HACKERS CAN USE THIS TO PIVOT DEEPER INTO A NETWORK. I FOUND A TOOL THAT MAKES IT POSSIBLE WITHOUT PROXYCHAINS. Ligolo-ng lets pentesters tunnel into internal networks through compromised hosts without relying on proxychains. → Reach internal network services → Run Nmap scans through a tunnel → Explore network paths during pentests → Manage multiple agents and tunnels → Supports Windows, Linux, macOS and BSD if you're into hacking, bug bounty, red teaming, or pentesting, this one is worth knowing. BOOKMAKER IT REPO BELOW
- Oct 19, 202657x their median
I found a CRITICAL auth bypass in Laravel 🚨 (9.2/10) On MySQL/MariaDB, Laravel's token API guard let an unauthenticated attacker log in as an existing victim user. Patched in 12.68.0 & 13.29.0. Thanks to the @laravel team & @taylorotwell for the fast fix 🙏 More info 👇 https://t.co/tQ5ZL9Oz63
- Dec 14, 202555x their median
I have built: - A security testing repo: https://t.co/HMJzUDi8Fv - An API hacking tool: https://t.co/hi8nDg3ma5 - A blog: https://t.co/zBSMjqpcWq (Yeah I know cert expired, will look into that today) - 150 exploits + 6 lifelike labs: https://t.co/jLmNLzsTlZ - A student base of over 180 000 big: https://t.co/RXc5kZoGIr - A wealth of courses: https://t.co/RF9xHvny3W - A youtube channel with over 1200 video's: https://t.co/1fblu7Byq2 - A medium with over 7300 followers: https://t.co/VTeUYZIoh6 - An incredible fanbase of over 50 000 rats on youtube + 150 000 here - A discord server with over 10 000 members + one for CAPIE + CNWPP + Hacker's toolkit - A list of 10 students i got to directly reporting bugs: https://t.co/CDlzXdNvPB - A song: https://t.co/nYQUGk0DV9 (No AI) - A family of my own - Reports on some of the giants of this earth - A pentesting company And still i get constantly attacked for not knowing anything - just copy pasting shit and not being good enough :-) hahaha you are so funny - THEN GO DO BETTER <3 Much love rat pack!! Thank you for the support!
- Oct 19, 202638x their median
deserved a statue. insane bug https://t.co/ZN05cDSnzm https://t.co/5DJnsrLQ0O
- Oct 19, 202633x their median
Yesterday, I received a great reward for discovering a critical vulnerability. The program is paying really well, which makes the effort even more worthwhile. I still have dozens of reports under review, and I’m hoping for more positive outcomes and rewards in the coming days. https://t.co/QgDtnqrDA9
- Oct 19, 202616x their median
Happy Monday Bug Bounty Hunters with a Triaged Critical Severity from me and @badcrack3r in @intigriti Bug Bounty Platform🙏 https://t.co/U11fB4i6l6
- Oct 19, 202615x their median
Bug Bounty Tip: 403 Bypass via Path Fuzzing Look for: GET /admin returning 403 Forbidden Test path variations: /admin/, /admin/., /admin%2f, /admin%20, /admin..;/, /%2e/admin, /ADMIN, /admin?, /admin#, /./admin, and header tricks like X-Original-URL: /admin or X-Rewrite-URL: /admin. If any variant returns 200 with admin content, it may indicate Access Control Bypass, enabling unauthorized access to admin panels, internal APIs, or restricted functionality. For more tips join our Telegram channel: https://t.co/ZemJJygdHY #BugBounty #403Bypass #AccessControl #PathFuzzing #InfoSec
- Oct 19, 202614x their median
2000 euro for SQLi ❤️ https://t.co/pKm2d9DBjN
- Oct 19, 202612x their median
GPO Abuse in Active Directory: Domain Takeover ⚠️ 🔥 Telegram: https://t.co/upuP8k8ckB ✴ Twitter: https://t.co/Za7rYILz6E GPO Abuse is a critical Active Directory attack technique where misconfigured Group Policy Objects allow attackers to escalate privileges and execute malicious actions across the domain. ⚡ Key Features of GPO Abuse 🔍 Identify writable GPOs using BloodHound 🧩 Abuse via SharpGPOAbuse / pyGPOAbuse ⚙️ Modify GPO to deploy malicious payloads 🛡️ Execute commands as SYSTEM 📡 Domain-wide impact via linked policies 🎯 Attack Capabilities 💥 Privilege Escalation to Admin 🧪 Remote Code Execution (RCE) 🧬 Persistence via Scheduled Tasks 🌐 Add users to local/domain admins ⚡ Full Domain Compromise 📖 Article: https://t.co/kVW2ghan3q #ActiveDirectory #RedTeam #Pentesting #CyberSecurity #EthicalHacking #InfoSec #ADSecurity
- Oct 19, 202610x their median
Earlier this year, we explored agentic vulnerability discovery across a diverse set of targets, such as Windows drivers, XNU, firmware, web apps, etc. We share our experiences here: https://t.co/bWsEEPLpA2 Fun fact: better decompilation can help reduce false positives!
Ranked by total interactions across everything we have tracked for this account, which is a longer history than the 30-day window the rates above use. The multiple compares each post to this account's own median.
Recurring topics
The most frequent hashtags in the sampled posts. They describe what this account writes about; they are not a performance signal, and the catalog-wide breakdown on the hub shows how little hashtag count moves.
Buy or sell Twitter (X) accounts - escrow-protected
PlayerSells is an escrow marketplace for Twitter (X) accounts. Every deal is protected, with no middleman risk.
Reading these numbers
A typical post picks up 11 interactions against 170K followers, an engagement rate of 0.006%. Measured over 39 original posts, its engagement rate beats 19% of 20,444 tracked accounts of a similar size. That is a reason to look at how the audience behaves - reply depth, saves, whether the followers are recent - rather than a conclusion about it on its own. Posts are seen about 2.0K times each, and 0.539% of those impressions turn into an interaction. That is about 1.20% of the follower count, which is the gap between an audience on paper and an audience in a timeline. Posting runs at about 2 posts a day over the last 30 days, though only 10% of days saw any activity at all. Most posts go out around 08:00 UTC, and Monday is the busiest day of the week. Of the 39 posts sampled, 38% carry an image or video and 77% link out. The account's strongest tracked post pulled 775 interactions, about 70x its own typical post. Recurring topics include #bugbounty, #infosec, #ai.
- What is The XSS Rat - Proud XSS N00b :-)'s engagement rate on X?
- The XSS Rat - Proud XSS N00b :-) (@theXSSrat) has an engagement rate of 0.006%, based on the median interactions across 39 original posts from the last 30 days against 169,570 followers. Replies, reposts and quote-posts of other people are excluded from that sample.
- Is that a good engagement rate?
- At 0.006%, The XSS Rat - Proud XSS N00b :-) sits above the 10th percentile of the 205,475 accounts in this comparison. Those comparison accounts are all large ones, because our scanning cadence is weighted towards big accounts, so this is a ranking among peers of similar scale rather than a ranking across X.
- Does @theXSSrat have real engagement?
- Its engagement rate beats 19% of the tracked X accounts closest to it in follower count (20,444 accounts), which puts it in the bottom quarter for its size group. Ranking inside a size band matters because engagement rate falls as accounts grow, so a raw rate would mostly re-measure the follower count. It is a starting point for a look at follower quality, not a verdict on it.
- When does @theXSSrat post?
- Most posts go out around 08:00 UTC, and Monday is its busiest day, at roughly 1.97 posts per day across the measured window.