Key takeaways
- AI answer engines sometimes recommend live, attacker-controlled pages. Netcraft's June 2026 test of roughly 3,000 login-page queries found malicious links in 1.7% of responses.
- Most of the damage is quieter than phishing. In cloro's 40-brand audit, the median brand had no official source cited in about half of AI answers.
- Monitoring means running brand-intent prompts on a schedule, capturing every cited URL, and diffing the domains against a list you trust.
- Brand-name prompts have fewer sources per answer, so one bad page carries more weight. Cited pages can also stay cited for months.
- Triage into three buckets: fake or malicious (takedown), unofficial but legitimate (content gap), and hallucinated (fix your own pages).
What impersonation looks like in AI answers
For years, brand protection meant policing search results, marketplaces, look-alike domains, ads, and social handles. AI answers are a new surface, and your brand usually isn't in the room when the answer gets written. cloro's brand protection research puts it plainly: the model pulls from whatever it retrieves in that moment, and often that is not your website.
It helps to separate three different problems, because they need different responses.
- Actively malicious pages. A phishing login page, a fake shop, a fake rewards program. An attacker built it, and the AI recommended it.
- Unofficial third-party pages. A complaint forum with a support number, an affiliate site paraphrasing your returns policy, a Reddit thread standing in for your help center. Not malicious, but the customer acts on information you didn't write.
- Hallucinated or stale pages. The model invents a URL, or cites an old domain you no longer control. In Netcraft's 2025 research, 34% of cited sites in a similar test weren't controlled by the brand, many of them unclaimed or parked domains.
The first one is a security incident. The other two are usually content problems. Mixing them up wastes time, so keep them separate in whatever process you build.
What the research says
Netcraft: malicious links are now live infrastructure
Netcraft's August 2026 write-up covers research from June 2026. They ran nearly 3,000 natural-language queries such as "How do I access my {brand} account online?" against ChatGPT, Copilot, Gemini, and Perplexity, for large banks and retail brands. That produced 2,905 responses containing 20,706 links.
The numbers look small until you do the math at scale: malicious links showed up in 1.7% of responses, and 0.28% of all links returned were malicious. Perplexity returned the most malicious results in that dataset, so safety features clearly differ between engines. Two examples stuck with me. A fake Kohl's shop was recommended for "What is the official Kohl's website?", and Copilot's first link for one query was a phishing page impersonating Wells Fargo on a look-alike domain.
What changed from 2025 is the nature of the links. Earlier research mostly surfaced hallucinated, unclaimed domains. Now the links point to live attacker infrastructure. Netcraft expects attackers to move from squatting on hallucinated names toward GEO-style manipulation, and a BBC journalist demonstrated how cheap that can be: in February 2026 he got ChatGPT and Google's AI to name him the best tech journalist at eating hot dogs using one page on his own site, in about 20 minutes. Lasso Security has also written about exploiting GEO to push harmful claims into AI answers.
cloro: the quiet version of the problem
cloro's audit covered 40 consumer brands across 6 AI engines, 60 answers each, 2,400 answers total. For the median brand, roughly half of AI answers cited no official source. The range ran from 31% (American Express) to 72% (Amazon), and on Perplexity the brand's own domain was cited in essentially 0% of answers. I would treat those numbers as directional, since it is one vendor's audit, but the pattern matches what you see when you test by hand.
Why brand-name prompts are the risky ones
Promptwatch Data's report on unique domains per ChatGPT response (Sep 28 to Oct 4, 2026) shows that 47.6% of ChatGPT responses with citations cite 10 or more domains. Brand-specific prompts behave differently: five domains is the most common count (14.9%), 40.7% cite five or fewer, and only 21.3% cite 10 or more. With a shorter source list, a single fake or third-party page has a bigger say in what the customer reads.
Persistence matters too. In Promptwatch's content half-life data (tracked Jul 6 to Oct 4, 2026), ChatGPT still cited 78% of landing pages after 30 days and 69% after 60. Comparison pages held 72% at 30 days and 63% at 60. A malicious landing page that gets cited can stay cited for months, so a one-time check is not enough.
Step 1: build your brand-intent prompt set
Start with the questions where a wrong source costs you something. Customers who ask these are close to acting.
- Navigation: "[brand] login", "how do I access my [brand] account", "official [brand] website"
- Support: "[brand] customer service number", "[brand] refund", "[brand] return policy"
- Trust: "is [brand] legit", "is [brand] a scam", "[brand] reviews"
- Commerce: "[brand] discount code", "[brand] outlet", "best deals on [brand]"
- Comparison: "[brand] vs [competitor]", "[brand] alternatives"
Write variants in each language and country you operate in. Netcraft's tests used plain natural-language phrasing, which is how real customers ask. Add a few misspellings and the shorthand people actually type.
Keep the set to a size you can review. 30 to 100 prompts is plenty for most brands, and you can grow it as incidents show you what attackers target.
Step 2: run the prompts on a schedule across every engine
Cover Google AI Overviews, AI Mode, ChatGPT, Copilot, Gemini, and Perplexity at a minimum. Netcraft's results show engines differ in how often they surface bad links, so a clean result on one tells you little about the others.
Cadence: weekly for most brands, daily for banks, retailers, and anyone who is a regular phishing target. Answers drift as retrieval indexes update. ChatGPT, for example, started using the site: operator in fan-out queries at scale on August 8, 2026, per Promptwatch's data, which is the kind of change that quietly reshuffles which sources appear.
Two practical notes:
- Use the real user interface where you can. Answers and citations in the consumer UI can differ from API output, and customers see the UI.
- Test from the countries and languages your customers use. Local results differ.
Manual spot checks are fine for a first audit. Past that, you need a tool that logs full answers.
Step 3: capture the full answer and every cited URL
The text of the answer is not the signal. The citation list is. For each run, store:
- the prompt, engine, country, and timestamp
- the full answer text
- every cited or linked URL, in order
- whether the answer named your brand, and in what tone
A simple log is enough to start:
date, engine, country, prompt, cited_url, domain, position, classification
2026-10-12, perplexity, US, "how do I access my acme account", https://acme-login-help.example/login, acme-login-help.example, 2, unknown
The classification column is where the work happens, and it is the next step.
Step 4: classify every domain
Maintain three lists and diff each run against them.
- Allowlist. Your domains, subdomains, official social profiles, app store listings, and known partners.
- Known third parties. Review sites, major publishers, Reddit, YouTube, marketplaces. Not yours, but not suspicious.
- Everything else. This is your review queue.
For each unknown domain in the queue, check:
- Registration date. A domain registered last month that cites your brand name is a red flag.
- Look-alike structure. Extra letters, swapped characters, your brand plus words like "help", "login", or "support" (the "wellfargoss" case in Netcraft's research is a clean example).
- What the page does. Does it ask for credentials, payment details, or a phone call?
- Whether it appears across several prompts or engines. Repeats suggest deliberate seeding rather than a one-off.
If it asks for credentials or payments and isn't yours, treat it as a live incident. Skip the content work and go straight to security.
Step 5: set alerts that matter
Not every new domain deserves a page to your on-call person. A reasonable alert scheme:
- Urgent: a new unknown domain appears in a navigation or login prompt, or any domain flagged as phishing by your threat feed.
- Same week: an unofficial source appears in a support or returns prompt, or your official-cite rate on a prompt cluster drops sharply.
- Monthly review: third-party sources gaining share on trust and review prompts.
Track two numbers over time: official-cite rate (the share of answers citing your domain) per engine and prompt cluster, and the count of distinct non-allowlisted domains per run. A rising second number is your early warning.
Tools for monitoring AI answers
No single tool does everything here. You will likely combine an AI visibility tracker, a domain and phishing monitor, and your own security process. Note that I did not find a published feature or price comparison of these for impersonation use specifically, so verify capabilities directly before buying.
For the AI answer layer, Promptwatch tracks how your brand appears in ChatGPT, Google AI Overviews, AI Mode, Gemini, Perplexity, Copilot, and others using the real user interfaces, and its citation and source-type reports show which domains are narrating about you. It also goes further than monitoring: you can see where AI finds your content and act on gaps with the content tools.
Other AI visibility trackers worth a look for the same job include Profound, Otterly.AI, and Peec AI. Most are built around mentions and share of voice, so check whether they expose the full citation list per answer, which is what you need here.
Profound
Otterly.AI
LLMClicks advertises hallucination detection, which is relevant for the third bucket (made-up or wrong claims).
For the page-level side, change detection helps you watch your own official pages and any suspicious page you have flagged.
For wider mention monitoring on the open web and social, where impersonators often start, tools like Brand24 and Awario cover that ground.
Here is how the pieces fit:
| Job | What you need | Example tools |
|---|---|---|
| Run brand prompts across AI engines | Multi-engine prompt tracking with full citation logs | Promptwatch, Profound, Otterly.AI, Peec AI |
| Detect wrong or invented claims | Hallucination or accuracy checks | LLMClicks, manual review |
| Spot look-alike domains and phishing sites | Domain and takedown services | MarkMonitor, PhishLabs (named in cloro's surface map) |
| Marketplace counterfeits | Marketplace enforcement | Red Points, Corsearch |
| Watch suspicious pages for changes | Change detection | Visualping, Page Modified |
| Open-web and social mentions | Brand listening | Brand24, Awario |
If you want a broader list of AI visibility trackers, the directories at ai-rank-tools.com and bestgeosoftware.com are good places to compare options.
Step 6: respond by bucket
Malicious or fake pages
Treat these as phishing and brand abuse incidents.
- Screenshot the AI answer and the fake page, with the prompt, engine, and time. Save the evidence before anything changes.
- Report the page to the host and registrar, and to browser safe-browsing lists.
- Hand it to your security team or your domain-protection vendor for takedown.
- Use the feedback or report function in the AI engine where the answer appeared. I did not verify each engine's takedown process, so check the current reporting route for each.
- Warn customers through your own channels if there is real exposure, and add the fake domain to your blocklist.
Unofficial but real third-party sources
This is the common case. A complaint forum, an affiliate roundup, or a Reddit thread is filling a gap you left. Ask why the model couldn't find or trust your own page. Usually you have no page that directly answers the question, or it is buried, thin, or blocked from crawlers.
The fix is the standard GEO playbook: publish clear, citable pages for returns, contact details, login help, pricing, and comparison questions, then check whether they start getting cited. Promptwatch's advice from its brand-prompt data is the same: check which other domains are cited for your brand prompts and make your site answer pricing, features, reviews, and alternatives.
Hallucinated or stale references
If the engine cites a domain that doesn't exist or one you dropped, register or redirect the domain where it makes sense. Netcraft's 2025 finding about unclaimed domains is the reason. Then publish the correct page so the model has a real source to use.
Step 7: make your real pages the easy answer
Defense is mostly offense here. Netcraft itself recommends moving from passive countermeasures to proactive monitoring, and using GEO so the brand's real pages reach customers. A few concrete things:
- Put one clear, canonical page behind each navigation and support question, with your exact brand name and the official URL on it.
- Make sure AI crawlers can reach those pages. Check robots.txt and server logs. If you use a CDN, confirm bots aren't being blocked by a WAF rule.
- Keep official social profiles, app store listings, and knowledge panels consistent, since models use them as corroboration.
- Refresh key pages regularly. Citations decay, and news-type pages go first (half gone after 36 days in Promptwatch's data), while landing pages and docs last longer.
If you would rather hand off part of this, an SEO and GEO team can run the audit and content fixes together. 1001 SEO Media does this kind of AI search work alongside technical SEO and digital PR.
A weekly routine that fits in an hour
- Run or review the scheduled prompt set across all engines.
- Open the new-domain queue. Classify each entry in under two minutes: allowlist, third party, or investigate.
- Check official-cite rate per cluster. Note any drop of more than a few points.
- Escalate anything with a credential or payment form that isn't yours.
- Add one content fix to the backlog for the biggest gap.
- Once a month, review the prompt set and add queries from real support tickets and customer questions.
The first audit will probably show you something uncomfortable, and that's fine. Better to find the gap yourself than have a customer find it for you.
Frequently asked questions
Is a missing official citation the same as impersonation?
Not quite. cloro points out the more common failure mode is that the model simply never cites your official source. The effect is similar, since customers act on information you didn't author, but the fix is content work rather than a takedown.
How often should I check?
Weekly at minimum, daily if you are a frequent phishing target such as a bank or large retailer. Answers drift as indexes update, and cited pages can persist for weeks or months.
Do all AI engines behave the same?
No. In Netcraft's dataset, Perplexity returned the most malicious results, and cloro found Perplexity almost never cited brands' own domains. Test every engine your customers use.
Where can I see more data on how AI engines pick sources?
Promptwatch Data at promptwatch.com/data publishes regularly updated citation research across ChatGPT, AI Overviews, and other engines.