Seems like this has been fixed. Twitter was performing simple substitutions of Twitter -> X. 

For example, you could register a malicious domain carfatwitter.com, and this would be displayed as Carfax (replace Twitter with X).

Seems like this has been fixed. Twitter was performing simple substitutions of Twitter -> X. 

For example, you could register a malicious domain carfatwitter.com, and this would be displayed as Carfax (replace Twitter with X). 

https://krebsonsecurity.com/2024/04/twitters-clumsy-pivot-to-x-com-is-a-gift-to-phishers/

/mantej | Cryptography Engineering at Cash App

In their defense, Twitter has been a gift for phishers even without this.