The filter also permitted the phishing link when the "www" subdomain was stripped from the front of the URL.

Twitter did not return messages seeking comment.

"This is a common problem with this sort of filtering service," said Chris Boyd, director of malware research with FaceTime Security Labs.

Boyd said it will probably take Twitter "a while" to get its Web filtering up and running properly, "but even some protection is better than none."