Recently I asked a chatbot for a courier's tracking site, and it answered instantly, with total confidence: a clean, plausible-looking address. Helpful, right? Except the bot may have made that address up. And if a scammer registered that exact invented name first, the page that loads looks like the real brand and is built to take your card number. Let's unpack this one together.
Wait, AI makes up website addresses?
Yes, and more often than you'd guess. Large language models (the technology behind chatbots) don't look up facts in a database. They predict text that sounds right. Most of the time that's fine. But when you ask for a specific web address, the model sometimes assembles one that looks completely reasonable, follows the usual pattern for that kind of brand, and simply doesn't belong to anyone. This is called a "hallucination": confident output that isn't true.
With a fact, a hallucination is annoying. With a web address, it's an opening. Because a made-up domain that nobody owns is a domain someone else can go register.
Phantom squatting: the trick has a name
Security researchers at Unit 42, the threat-intelligence team at Palo Alto Networks, gave this pattern a name in research published on June 30, 2026: phantom squatting. The idea is simple and unsettling. Chatbots repeatedly invent the same plausible brand addresses; attackers register the unclaimed ones and inherit the trust people place in whatever a helpful AI just told them.
To measure it, the team ran 685,339 adversarial prompts across 913 global brands through two families of large language models. Those prompts produced roughly 2.1 million unique web addresses. Among them, 13,229 were already classified as malicious. And the cherry on top: about 250,000 of the invented brand domains were unregistered, sitting available for an attacker to take over.
The Hacker News, reporting on the same study, described the vector bluntly as "inherently unpatchable." There's no software update that stops a model from occasionally inventing a name, and no patch that un-registers a domain a scammer already bought.
How does the trap actually spring?
The most telling part of the research is the timing. Unit 42 found they could predict which hallucinated domains attackers would register 18 to 51 days in advance. In other words, the model invents a name; that name stays quietly available; then, weeks later, a scammer registers it and turns it into a live phishing site.
Their clearest example is a case they call Montana Empire. A hallucinated address for a postal e-commerce marketplace was flagged on March 8, 2026. On March 31, 2026, 23 days later, an attacker registered that exact domain and weaponized it as an AI-built phishing kit designed to steal card details, bank information, and national-ID data.
the brand's actual, registered sitewhat you were looking fora plausible address the AI made upunclaimed for weeks, then registered by a scammerNotice what's different from the classic letter-swap fakes. There's no misspelling to catch, no zero-for-O, no sneaky capital I. The address can look perfectly ordinary, because a brand name plus a normal-looking pattern is exactly what the model produces. The only thing wrong with it is that it was never the real brand's address in the first place. 😅
Where will you run into this?
- Asking a chatbot for a company's website. "What's the login page for my bank?" or "Give me the tracking site for this courier." A confident answer is not a verified one.
- Code and setup instructions from AI. The Unit 42 research frames this partly as a software supply-chain problem: developers paste AI-suggested package links and endpoints into projects, and a hallucinated one can point at attacker-controlled infrastructure.
- Any "just click this" convenience. The whole appeal of an AI answer is that it saves you a search. That same shortcut skips the step where you'd normally have noticed the address was unfamiliar.
How do you protect yourself?
The fix isn't to distrust AI entirely. It's to treat any web address a bot hands you as unverified until you've checked it. A few habits:
- Don't click a bot's link straight through. Copy the address instead of tapping it, so you can look at it before you go anywhere.
- Reach the brand a way you already trust. Type the address you know, use a bookmark, or search for the official site rather than taking the invented one on faith.
- Be extra wary of a brand-new-looking domain. A phishing site built on a freshly registered hallucinated name is, by definition, young. A recent registration date on a "known" brand is a red flag.
- Paste the address into a checker and see whether it's a known brand's real domain, whether it's been reported, and how old it is, before you type anything into it.
How does IP Tracker help here?
IP Tracker is a free Chrome extension. Paste a domain (or a full email address) into the popup; the free tier gives you 25 checks a day, with no account and no tracking. Only the value you paste is looked up.
For an address a chatbot hands you, it runs several checks at once. It compares the domain against the official domains of roughly 100 widely impersonated brands, so if the invented name is trying to pass as a bank, courier, or payment service you'll see how it lines up. It shows whether Google Safe Browsing (Google's list of reported dangerous sites) has flagged it, how many security vendors flag it on VirusTotal, and any community abuse reports. And it surfaces the domain's creation date, which is the single most useful clue against phantom squatting: a phishing site living on a freshly registered hallucinated domain is often only days old. If the domain is under 90 days old, the banner adds a "Registered N days ago" line as a supporting clue.
What can't it do?
Honesty matters more than comfort here, so a few limits worth knowing:
- It can't tell you the AI invented the name. IP Tracker checks the domain in front of it. It doesn't know whether a chatbot conjured it or whether it's the brand's real site; that's why the age, reputation, and lookalike signals together matter.
- Brand-new domains outrun blocklists. This is the core of the problem. The Unit 42 example was weaponized 23 days after the name first appeared. Google Safe Browsing is strong on known bad sites, but a domain registered days ago may not be listed yet, which is exactly when it's most dangerous.
- The brand list is about 100 brands. The most impersonated ones, not every company. A hallucinated address for a smaller or regional brand may not match the list.
- A "clean" result is a snapshot, not a promise. The signals reflect what's known right now. On the newest domains, "known" is thin.
The uncomfortable takeaway from the research is that this vector is, in Unit 42's framing, hard to patch away. Models will keep occasionally inventing plausible names, and the gap between invention and weaponization can be just a few weeks. Your defense isn't technical; it's a pause. When an AI hands you a web address, treat it as a suggestion to verify, not a destination to trust.
To summarize:
- ✓ Treat any web address from a chatbot as unverified.
- ✓ Reach brands through a route you already trust, not the invented link.
- ✓ Watch for freshly registered domains posing as established brands.
- ✓ Or paste the address into IP Tracker and read the age, reputation, and lookalike signals first.
Stay sharp, and don't let a confident bot do your checking for you! 😎