Like SEO, LLMs May Soon Fall Prey to Phishing Scams

Netcraft's test shows GPT-4.1-family models frequently return incorrect or unowned domains when asked for brand login pages; many suggested domains were unregistered, parked, or belonged to unrelated entities. The report warns attackers can weaponize these hallucinated URLs by creating AI-optimized content (GitBook pages, blogs, GitHub repos) so LLMs and AI-enabled search engines recommend phishing or malicious sites, and urges model developers and brands to implement URL verification, monitor AI-suggested impersonations, and pre-register high-risk lookalikes.