What Is Phantom Squatting? The Emerging Threat Where AI Hallucinations Fuel Domain Hijacking

The Attack Chain: From AI Hallucination to Domain Hijacking

Phantom squatting follows a straightforward but dangerous three-step process that exploits the way large language models (LLMs) handle missing information .

Step 1: Probing for hallucinations. Attackers systematically prompt AI models to discover "phantom" domains the models tend to hallucinate for specific brands . LLMs can generate "perfectly structured, highly convincing URLs" that point to domains that have never been registered before .

Step 2: Registering the phantom domain. Once a hallucinated domain is identified, the attacker purchases the unregistered domain for a few dollars, sets up malicious infrastructure, and waits .

Step 3: Exploiting user trust. Victims — whether a human user or an autonomous AI agent — follow the AI-generated link and walk into a trap . By the time a traditional security feed flags the domain as malicious, the damage is often already done .

This represents a meaningful shift from traditional cybersquatting. Classic cybersquatting relies on human typos or look-alike domains such as "netflix-payments[.]com" . Phantom squatting replaces human error with AI hallucination, turning the model's own flaw into the attack vector .

Real-World Examples and Related Techniques

Palo Alto Networks has not publicly disclosed specific brand names or domains caught in phantom squatting campaigns, but several documented patterns provide concrete context .

Customer-support impersonation. Phantom squatting can be used to create phishing links that impersonate legitimate brand or support URLs generated by an AI system . The attack exploits the fact that users may trust a link more when it appears to come from an AI assistant .

AI-themed phishing and squatting. Palo Alto Networks has reported a boom in traditional malware and phishing techniques taking advantage of interest in AI and ChatGPT . Between November 2022 and April 2023, Unit 42 observed a 910% increase in monthly registrations for domains related to ChatGPT, and up to 118 daily detections of ChatGPT-related malicious URLs . The attackers' goal is to lure ChatGPT users to seemingly related sites designed to infect them .

Related technique: "Slopsquatting." A parallel supply-chain variant — called slopsquatting — targets AI-hallucinated software-package names instead of domain names . In this model, attackers identify fabricated package names that LLMs frequently recommend for coding tasks, register those names on public repositories like npm, PyPI, or RubyGems, and embed malware . When a developer asks an AI assistant for a solution, the assistant confidently suggests the phantom package, and the developer installs it, trusting the AI's authoritative tone . Research across 16 models found that approximately 19.7% of packages recommended by AI coding tools were entirely fabricated — over 205,000 hallucinated package names .

Defenses Palo Alto Networks Recommends

Palo Alto Networks outlines several defensive layers to mitigate the risk of phantom squatting:

1. Proactive domain monitoring. Organizations should monitor for suspicious squatting domains. LLM-based systems can also be used defensively: research on DomainLynx showed that a compound AI system achieved 94.7% accuracy on a dataset of 1,649 squatting domains, detecting 34,359 squatting domains from 2.09 million new domains in a month-long real-world test .

2. Newly Registered Domain (NRD) filtering. Palo Alto Networks' Advanced DNS Security includes a signature for Newly Registered Domains (UTID 109020001) . Newly registered domains are domains recently added by a TLD operator or that changed ownership within the last 32 days, and many are used to facilitate malicious activities such as operating command-and-control servers or distributing malware .

3. DNS-layer protections. DNS security controls can inspect or block traffic to risky domains, including NRDs commonly abused in phishing and social engineering . Advanced URL Filtering (AURL), powered by Precision AI and real-time, inline deep learning detectors, can identify and block never-before-seen phishing domains as they emerge .

4. User education and AI-output verification. Users should treat AI-generated URLs with caution and verify high-stakes outputs through human review, trusted databases, APIs, or curated knowledge bases . Cross-referencing model responses against authoritative sources is critical for any high-stakes use case .

5. AI-agent guardrails. Autonomous agents and AI-assisted workflows should validate generated URLs, package names, and other external resources against trusted sources before fetching, installing, or acting on them . This is especially important for coding assistants, where the slopsquatting variant poses direct risk to development pipelines .

Bottom Line

Phantom squatting is a practical emerging threat that weaponizes a known AI flaw — hallucination — against users who trust AI-generated outputs . The attack exploits the very feature that makes LLMs useful: their ability to generate plausible-sounding content with confidence, even when the underlying reference does not exist. To defend against it, organizations need a layered approach combining proactive domain monitoring, strict DNS/NRD filtering, user education, and AI-agent guardrails that treat AI-generated URLs as untrusted until independently verified .