attackers are pre-registering domains that AI will hallucinate — before anyone asks

There’s no phishing email. No typosquatted domain designed to fool a tired eye. The AI just… recommends the malicious site itself.

Palo Alto Unit 42 has a name for it: phantom squatting. The mechanic is almost elegant in how broken it is. LLMs hallucinate brand domains with enough consistency that attackers can run the same prompts, harvest the fake URLs, register them first, and sit waiting. When a user asks their AI assistant for the right link, the model confidently sends them to a domain the attacker already owns.

the numbers are not small

Unit 42 ran 685,339 queries across 913 brands and got back 2.1 million URLs. Of those, roughly 250,000 hallucinated domains were sitting unregistered — a pre-built shopping list for anyone paying attention. Among the domains attackers had already grabbed, Unit 42 counted 13,229 confirmed malicious URLs.

The timeline data is what makes this feel real rather than theoretical. On March 8, Unit 42’s system predicted the models would invent a domain resembling a national postal service’s online marketplace. 23 days later, on March 31, an attacker registered that exact domain and stood up a phishing kit — the one researchers later tracked as ‘Montana Empire.’

That’s not coincidence. That’s a workflow.

why this is different from normal squatting

Typosquatting requires a user to mistype. Combosquatting requires a user to trust the wrong variation. Phantom squatting requires the user to do nothing wrong at all — they asked a legitimate question and the model gave them a confidently wrong answer that someone turned into a trap.

The attack surface scales with LLM adoption. Every AI assistant, every coding copilot that recommends a package URL, every chatbot that drops a support link — if the model hallucinates a domain with any regularity, that domain is worth parking.

what to actually do about it

If you’re a brand: run the prompts yourself. Ask every major LLM variants of “what’s the official site for [your product]” and collect what it hallucinates. Anything unregistered that comes back more than once is a pre-crime squatting target. Register it or at minimum monitor it.

If you’re a developer embedding LLM output into anything that touches URLs: don’t let the model generate links you don’t validate. Ground URL generation in a known-good list, not the model’s parametric memory.

If you’re a user: don’t click links an AI chatbot gives you without checking. Not because the AI is malicious — because someone already bet that you would.