Phantom Squatting: When AI Hallucinated Domains Become Attacker Infrastructure

Short summary

Phantom squatting is a new security attack where adversaries register domain names that AI assistants hallucinate, then redirect traffic to phishing or malware pages. Current defenses fail because newly-registered domains have clean reputations and AI output filters don't verify whether URLs actually exist. SlopScan, a free security tool, detects hallucinated domains by checking live registries before serving AI responses to users.

• •LLMs confidently recommend fake domains they've pattern-matched from training data
• •Attackers register these hallucinated domains for phishing and malware delivery
• •Standard security tools fail: reputation filters miss fresh domains, AI output filters don't verify URLs exist

Generated with AI, which can make mistakes.