X Corp. secured control over 47 domains it alleges were used in a coordinated phishing operation, according to a UDRP panel decision dated November 9, 2026. The domains, including dismissal-x.com, conduct-x.com, and disputes-x.com, were seized after X filed a cybersquatting dispute claiming they were fronts for phishing emails that impersonated X communications.
Phishing scheme details
The phishing scheme sent messages that mimicked X policy notices, DMCA alerts, and appeal letters, adding artificial deadlines to pressure recipients into clicking links. Those links led to pages that replicated X’s login and appeal interfaces, matching layout, typography, color scheme, and logo. Victims who entered credentials and one-time 2FA codes had their accounts taken over in real time.
UDRP outcome and timeline
X’s UDRP panelist ruled in favor of the company and ordered the transfer of the disputed domains. While UDRP can be used to take control of phishing domains, the process can take weeks, during which time the domains remain active.
How to verify and protect yourself
Readers can verify the domain status by querying WHOIS or using a DNS lookup tool. If a domain appears in the list of seized domains, it should no longer host phishing pages. Users who received suspicious emails claiming to be from X should check the sender address and verify the URL by hovering over links before clicking.
Immediate protective action: If you suspect a phishing email, do not enter credentials on any linked page. Report the email to X’s support and consider changing passwords and enabling two-factor authentication on all accounts.