28/09/2026
A domain can call itself “official”, “verified” or even “not-phishing”.
That still does not make the wording evidence.
A new research preprint tested whether short claims inside constructed brand-like domain names could change how AI systems judged them. It covered 622,080 judgements across five language models and 64 brands.
The effect varied.
In one setting, a group of risk-denial terms reduced alerts by 45.3 percentage points. In others, similar wording increased alerts or made little difference.
That inconsistency is the useful lesson. A model should judge the name, not accept the name’s own description of itself.
The research used constructed names rather than live attacks, so it does not show that a real scam would succeed. It does show why “official” inside a domain should never count as independent proof.
A domain can describe itself. It cannot verify itself.
Would the word “official” make you more suspicious or less?
Source checked: ClaimMirage research preprint, submitted to arXiv on 24 September 2026.