Twitter’s Clumsy Pivot to Is a Gift to Phishers

April’s Patch Tuesday Brings Record Number of Fixes
April 9, 2024
Why CISA is Warning CISOs About a Breach at Sisense
April 11, 2024
This post was originally published on this site

On April 9, Twitter/X began automatically modifying links that mention “” to read “” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com, which until very recently rendered as in tweets.

The message displayed when one visits, which Twitter/X displayed as in tweets and messages.

A search at shows at least 60 domain names have been registered over the past two days for domains ending in “,” although research so far shows the majority of these domains have been registered “defensively” by private individuals to prevent the domains from being purchased by scammers.

Those include, which Twitter/X truncated to when the domain appeared in user messages or tweets. Visiting this domain currently displays a message that begins, “Are you serious, X Corp?”

Update: It appears Twitter/X has corrected its mistake, and no longer truncates any domain ending in “” to “”

Original story:

The same message is on other newly registered domains, including (, (, (, ( and ( The message left on these domains indicates they were defensively registered by a user on Mastodon whose bio says they are a systems admin/engineer. That profile has not responded to requests for comment.

A number of these new domains including “” appear to be registered defensively by Twitter/X users in Japan. The domain (, to Twitter/X users) now displays a message saying it was “acquired to prevent its use for malicious purposes,” along with a Twitter/X username.

The domain mentioned at the beginning of this story — — redirects users to the blog of a Japanese technology enthusiast. A user with the handle “amplest0e” appears to have registered, which Twitter/X users would see as the CEO’s “” The domain “” already redirects to the real

Some of the domains registered recently and ending in “” currently do not resolve and contain no useful contact information in their registration records. Those include firefotwitter[.]com (, ngintwitter[.]com (, and webetwitter[.]com (

The domain, which Twitter/X until very recently rendered as “,” redirects to this blog post warning about the recent changes and their potential use for phishing.

Sean McNee, vice president of research and data at DomainTools, told KrebsOnSecurity it appears Twitter/X did not properly limit its redirection efforts.

“Bad actors could register domains as a way to divert traffic from legitimate sites or brands given the opportunity — many such brands in the top million domains end in x, such as webex, hbomax, xerox, xbox, and more,” McNee said. “It is also notable that several other globally popular brands, such as Rolex and Linux, were also on the list of registered domains.”

The apparent oversight by Twitter/X was cause for amusement and amazement from many former users who have migrated to other social media platforms since the new CEO took over. Matthew Garrett, a lecturer at U.C. Berkeley’s School of Information, summed up the Schadenfreude thusly:

“Twitter just doing a “redirect links in tweets that go to to instead but accidentally do so for all domains that end like eg going to” is not absolutely the funniest thing I could imagine but it’s high up there.”