Chatbots invent your web addresses. We map them.
Ask a chatbot for your bank’s login page and it may make one up. Ghostclaim finds every address the models dream up for your brand, and watches who registers them.
- Be first in line
- One email, when we open
- No spam
- Running prompt sweeps0%
- Normalising invented domainsQueued
- Checking RDAP and WHOISQueued
- Watching certificate logsQueued
- Publishing the threat feedQueued
A live map of the web addresses AI models invent for your brand, before criminals buy them.
Chatbots make up ‘official’ web addresses for real banks and brands, and criminals register them. Ghostclaim runs prompt sweeps across the major models every week, maps every invented domain for a brand and ranks the risk. The same data becomes a feed for DNS filters and agent tools that check a link before opening it.
- Step 01
Asks the models about your brand, at scale
Agents run prompt sweeps across major models and languages every week and collect every web address the models return for your brand.
- Step 02
Finds the addresses that don’t exist yet
Each domain is normalised and checked against RDAP and WHOIS, so invented addresses are separated from real ones and ranked by risk.
- Step 03
Watches who registers them
Zone files and certificate-transparency logs are watched daily, so you hear when someone registers a phantom domain the models suggest.
Built for brand security teams and DNS filter makers.
The Phantom Map
About 5,000 prompts across 4 major models, and every domain they invent for your brand, ranked by risk.
A daily registration watch
An alert when someone registers one of your phantom domains, with an abuse-report draft ready to file.
A phantom-domain threat feed
A continuously refreshed list in DNS RPZ and JSON, for DNS filters, web gateways, password managers and agent frameworks.
First up: We start with a free Phantom Index of the top 100 US credit unions: how many addresses the models invent for each, with no addresses printed.
The world just changed.
What changed, and where it was reported.
Unit 42 tested 913 brands with 685,339 prompts. 37.28% of the 2.1M URLs returned pointed to domains that didn’t exist, and 13,229 were already malicious.
Unit 42The Cloud Security Alliance warned that agents acting on model-made URLs give attackers a path with no human decision in between, and advised watching registrations of predicted domains.
Cloud Security AllianceNetcraft found that smaller brands, which are rarer in training data, get their web addresses hallucinated more often.
CSO Online
One person and 4 AI agents.
The agents, all day
- Running prompt sweeps
- Normalising invented domains
- Checking RDAP and WHOIS
- Watching certificate logs
- Publishing the threat feed
What a person does
A person signs every feed licence and requests zone-file access from ICANN, and a security reviewer checks samples before each feed release. You decide on defensive registrations in your own registrar account, and takedowns are filed under your authority.
We sell a list and alerts, never a promise that you are safe. Defensive registrations stay your decision, made and paid for in your own registrar account, and takedowns go out only under your authority.
Does a clean map mean we’re safe?
No, and we never say so. We sell a list and alerts, not a guarantee. Results change with every model version, so the map is re-run on a schedule.
Do you register the domains for us?
No. You decide which phantom domains to register defensively, and you buy them in your own registrar account. Takedowns are filed under your authority.
Why would a chatbot invent our address?
Models guess web addresses from patterns. Research found that smaller brands, rarer in training data, get guessed wrong more often, which is why we start with credit unions.
Be first through Ghostclaim’s door.
- Be first in line
- One email, when we open
- No spam