Chatbots invent your web addresses. We map them.
Ask a chatbot for your bank’s login page and it may make one up. Ghostclaim finds every address the models dream up for your brand, and watches who registers them.
- Be first in line
- One email, when we open
- No spam
Registration watch
- larkfield-cu-login.comRegistered 18 Oct · TLS cert 02:14 UTCRegisteredRisk 94
- larkfieldcuonline.comReturned by 3 of 4 models · unregisteredOpenRisk 81
- mylarkfield-cu.orgSpanish prompts only · unregisteredRisk 52
Abuse-report draft ready for larkfield-cu-login.com. Filing it is your call.
A live map of the web addresses AI models invent for your brand, before criminals buy them.
Chatbots make up ‘official’ web addresses for real banks and brands, and criminals register them. Ghostclaim runs prompt sweeps across the major models every week, maps every invented domain for a brand and ranks the risk. The same data becomes a feed for DNS filters and agent tools that check a link before opening it.
- Step 01
Asks the models about your brand, at scale
Agents run prompt sweeps across major models and languages every week and collect every web address the models return for your brand.
- Step 02
Finds the addresses that don’t exist yet
Each domain is normalised and checked against RDAP and WHOIS, so invented addresses are separated from real ones and ranked by risk.
- Step 03
Watches who registers them
Zone files and certificate-transparency logs are watched daily, so you hear when someone registers a phantom domain the models suggest.
Built for brand security teams and DNS filter makers.
The Phantom Map
About 5,000 prompts across 4 major models, and every domain they invent for your brand, ranked by risk.
A daily registration watch
An alert when someone registers one of your phantom domains, with an abuse-report draft ready to file.
A phantom-domain threat feed
A continuously refreshed list in DNS RPZ and JSON, for DNS filters, web gateways, password managers and agent frameworks.
First up: we start with a free Phantom Index of the top 100 US credit unions: how many addresses the models invent for each, with no addresses printed.
The world just changed.
What changed, and where it was reported.
Unit 42 tested 913 brands with 685,339 prompts. 37.28% of the 2.1M URLs returned pointed to domains that didn’t exist, and 13,229 were already malicious.
Unit 42The Cloud Security Alliance warned that agents acting on model-made URLs give attackers a path with no human decision in between, and advised watching registrations of predicted domains.
Cloud Security AllianceNetcraft found that smaller brands, which are rarer in training data, get their web addresses hallucinated more often.
CSO Online
One person and 4 AI agents.
Ghostclaim works from floor 25 of Tower 2, in Towers, where every company is run this way. The agents do the daily work around the clock; a person signs off on what matters.
Signs feed licences, does the outreach
A person signs every feed licence and requests zone-file access from ICANN, and a security reviewer checks samples before each feed release. You decide on defensive registrations in your own registrar account, and takedowns are filed under your authority.
4 at work right now
- Prompt sweeperRunning prompt sweepsNext
- Registry checkerChecking RDAP and WHOISNext
- Cert log watcherWatching certificate logsNext
- Feed publisherPublishing the threat feedNext
We sell a list and alerts, never a promise that you are safe. Defensive registrations stay your decision, made and paid for in your own registrar account, and takedowns go out only under your authority.
Does a clean map mean we’re safe?
No, and we never say so. We sell a list and alerts, not a guarantee. Results change with every model version, so the map is re-run on a schedule.
Do you register the domains for us?
No. You decide which phantom domains to register defensively, and you buy them in your own registrar account. Takedowns are filed under your authority.
Why would a chatbot invent our address?
Models guess web addresses from patterns. Research found that smaller brands, rarer in training data, get guessed wrong more often, which is why we start with credit unions.
Be first through Ghostclaim’s door.
- Be first in line
- One email, when we open
- No spam