“On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead.”
X rewrote any domain ending in “twitter.com” without checking where the string sat. So fedetwitter.com showed up in tweets as fedex.com and goodrtwitter.com as goodrx.com. At least 60 such domains got registered in two days, mostly by strangers grabbing them before scammers could. Users had to clean up a phishing hole that one line of string matching created.