Phishing sites impersonating Twitter/X

PhishDestroy has recorded 23 phishing domains impersonating Twitter/X since 2026-01-26, 2 of them in the last 30 days. The most used registrars are GoDaddy.com and NameCheap; the most common TLDs are .com and .pro. Open Twitter/X only from its official app or a saved bookmark.

23
Domains, all time
2
Last 30 days
14
Online at last check
1
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 12026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 12026-08-10: 12026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 12026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 12026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 12026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Twitter/X phishing domains detected per day: 6 from 2026-07-25 to 2026-10-22; peak 1.

How to tell a fake Twitter/X site

Words most often added to the brand in reported domains: dmca, accesses, suspicious, account, authentiq, noticedirect, privacy, tweetdownloader, admission, dmcaobject.

  • Type the address yourself or use a bookmark; phishing links for Twitter/X arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Twitter/X does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Twitter/X phishing domains

The 23 most recently detected domains impersonating Twitter/X
DomainFirst detectedStatus at last checkRegistrar
elontwitter777.xyz2026-10-10OnlineGlobal Domain
koltools.io2026-09-25OfflineImmaterialism
checked-x.com2026-09-07OnlineDynadot
breezetracker.pro2026-08-10OnlineSpaceship
twittxrtracker.com2026-08-09OnlineNameCheap
bloomtracking.com2026-08-04OnlineREGISTER S.P.A
privacyxcases-x.com2026-07-18OfflineNAMECHEAP
privacyxcase-x.com2026-07-18OfflineNameCheap
dmca-appeal-x.com2026-07-17OfflineNAMECHEAP
dmca-ticket-x.com2026-07-16OfflineNAMECHEAP
profileissuesx-x.com2026-07-10OfflineNameCheap
contentlab-x.com2026-06-15OnlineGoDaddy.com
testimonials-x.com2026-06-15OfflineDynadot
login-notificaiton-x.com2026-06-03OfflineGoDaddy.com
twitterbanservice.pro2026-06-01OnlineNICENIC
dmcaobject-x.com2026-04-16OnlineDynadot
admission-x.com2026-04-16OnlineDynadot
tweetdownloader.site2026-03-21OnlineGoDaddy.com
privacy-x.com2026-02-26Taken downNerd Names
noticedirect-x.com2026-02-23OnlineDynadot
authentiq-x.com2026-02-23OnlineGoDaddy.com
suspicious-account-x.com2026-02-13OfflineGoDaddy.com
accesses-x.com2026-01-26OnlineNameCheap

All 23 Twitter/X reports

Where they are registered and hosted

Registrars

  1. GoDaddy.com5
  2. NameCheap4
  3. Dynadot4
  4. NAMECHEAP3
  5. Dynadot1
  6. Nerd Names1
  7. NICENIC1
  8. REGISTER S.P.A1

Top-level domains

  1. .com18
  2. .pro2
  3. .site1
  4. .io1
  5. .xyz1

Hosting networks

  1. Cloudflare, Inc.9
  2. Amazon.com, Inc.3
  3. CLOUDFLARENET - Cloudflare, Inc., US2
  4. FDCSERVERS - FDCservers.net, US2
  5. OVH SAS1
  6. CLOUDFLARENET, US1
  7. AMAZON-02 - Amazon.com, Inc., US1
  8. Combell NV1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Twitter/X; share of all PhishDestroy reports: 0.01%.