ChatGPT is not a phishing scanner

The reply's core claim has three parts: models do not look only at page content; they check the link, the domain's age, and publicly available reviews; and results depend on model and mode. The verdict is mixed, and the qualification inside the claim is the most important part of it.

"Results depend on model and mode" is accurate, and it is the most useful part of the reply. Web-enabled ChatGPT, Claude, and Gemini can search the web and fetch pages when the mode allows it. With web search turned off, or in a model or API configuration without tools, the assistant cannot reach the network at all and answers from the URL string and its training data. That is not the same as ordinary ChatGPT chat: where search is available, ChatGPT may search automatically when it judges a question needs current information, so a pasted link can trigger a lookup without the user asking for one. "They check the link" is true in exactly those web-enabled modes, and Claude is the most explicit about it: its documentation says that with web search on it can retrieve content directly from a URL you provide.

The weak parts are domain age and public reviews. Nothing in the documentation of the three assistants describes automatic registration-data, domain-age, or reputation enrichment for a pasted link, so no vendor presents it as a standing capability, while the advice assumes one. The accurate version of the claim is conditional: an assistant can check link-adjacent facts only when its web tools are on, the user asks for the specific lookup, and the information is reachable, and even then the result is a search finding, not a security verdict.

The pattern across all three vendors is consistent. ChatGPT's search feature may run automatically when a question benefits from current information, and the user can turn it on manually. Search returns answers with source citations. Deep Research is a separate mode that searches over a longer run and produces a cited report. OpenAI's own limitations material says ChatGPT can be wrong, can produce citations that do not exist, and does not incorporate post-training information unless tools are used. Nothing there describes an automatic check of registration data, domain age, or multi-engine reputation for a pasted link. The closest OpenAI comes is its January 2026 post on agent link safety: before an agent fetches a URL automatically, OpenAI checks whether an independent web index has already seen that exact address, to stop private data leaking out through the URL. OpenAI states that this does not guarantee that the content of a page is trustworthy or that a site won't try to socially engineer you. That is the vendor making this report's point in its own words.

In Claude's current app, web search runs when Claude judges it useful; Anthropic's help page says the new Claude experience has no web search toggle. Outside that experience, for example on Team and Enterprise workspaces where an owner must first enable it, web search is still switched on per chat. When search is on, Claude can also fetch content directly from a page URL you provide. That is the strongest documented support for "it checks the link": give Claude a URL with search enabled and it retrieves and analyzes the page. It documents no automatic domain-age or reputation enrichment.

Gemini's documented capabilities are API tools. Grounding with Google Search connects the model to live web content with citations. URL Context retrieves content from URLs the developer provides, cache first with a live fetch fallback, and Google is explicit that it retrieves only the URLs provided, not nested links. Google also documents a content-moderation check on those URLs: a URL that fails it comes back with the status "unsafe". That check enforces Google's safety standards on what the model reads; Google does not describe it as a phishing verdict, and a URL that passes it has not been shown to be safe. These are developer-facing capabilities; I did not separately verify what the consumer Gemini app does with a pasted link, and the claims here about Gemini should be read as API-documented.

Web-enabled modes can search, fetch, and reason over what they find. None of the three documents consulting phishing blocklists or multi-engine reputation for a pasted link, or automatically pulling Registration Data Access Protocol (RDAP) registration data, redirect chains, certificate transparency, or hosting metadata. Gemini's URL Context runs a content-moderation check that can mark a URL "unsafe", and OpenAI's link-safety check only confirms that a URL is publicly known; OpenAI says outright that this does not mean the page is trustworthy. The signals that carry a phishing verdict exist, and they are gathered by tools built for the purpose.

Domain age is a concrete property of registration data. Since 28 January 2025, RDAP has been the definitive source for gTLD registration information in place of the sunsetted WHOIS service, per ICANN. An RDAP lookup can return created, updated, and expiry dates, subject to redaction. A language model cannot know a domain's creation date from the URL string. For an assistant to check it, the surrounding system needs direct RDAP or WHOIS tool access, a search or fetch of a lookup page, or an explicit user prompt asking for the lookup. No vendor documents this enrichment running automatically for pasted links.

Domain age is also a weaker signal than the advice implies. Attackers register fresh domains at scale, but they also buy aged domains, compromise legitimate ones, and hide behind subdomains and redirect chains. An old domain is not proof of safety, and a new one is not proof of phishing.

"Publicly available reviews" is plausible for judging whether a business is legitimate and weak as a phishing signal. A search-enabled assistant can look for a domain alongside "scam", "phishing", "Trustpilot", "Reddit", or regional review sites. But absence of reviews is normal for new and small legitimate businesses, and fake review pages are part of the attack surface, not independent evidence. The signals that matter for a link are reputation and blocklist results from purpose-built services, registration history, redirect behavior, and what the page actually does with credentials.

The original objection was that a professional phishing operation filters its visitors. On 18 June 2026 the FBI's Internet Crime Complaint Center (IC3) warned that cybercriminals use traffic distribution systems to selectively redirect visitors, filtering by IP address, operating system, location, device, and browser, and that a malicious TDS can display safe content to undesired targets, including security researchers. Infoblox and Confiant, studying Keitaro tracker abuse over a four-month window starting 1 October 2025, found roughly 15,500 domains used for malicious instances, with investment scams the dominant threat. Palo Alto Networks' Unit 42 describes malicious TDS infrastructure redirecting automated crawlers to legitimate websites to produce benign verdicts.

When an assistant fetches a URL itself, it typically does so from provider infrastructure, often with a declared AI user agent, and without the victim's cookies, referrer, or device fingerprint. That is a profile a TDS is built to recognize and decoy. SPLX showed in October 2025 that a single user-agent rule is enough to serve AI agents different content from humans: their test pages served altered content when the visitor was ChatGPT, Perplexity, or OpenAI's Atlas browser, and the assistants repeated it without flagging the mismatch. Agent and browser modes that drive a real browser look less like a bot, so the decoy is less certain there, but they still arrive without the target's context. The model then writes a confident verdict about a decoy page. This failure is not unique to LLMs; it affects ordinary URL scanners too, which is why serious detection products compensate with multiple vantage points, browser instrumentation, and historical telemetry. A single fetch from one vantage point is not a reputation check, regardless of who does the fetching.

The academic record supports a precise version of the claim. A 2024 paper by Lee, Lim, Hooi, and Divakaran uses multimodal LLMs to identify the brand of a webpage from logo, theme, and favicon and then compares the brand with the domain in the URL. A small-language-model benchmark by Goldenits, König, Raubitzek, and Ekelhart (arXiv, November 2025) treats phishing detection as a classification task over raw HTML. Most instructive is the SOUPS 2025 paper by Wang and colleagues, which builds an SMS phishing detection agent: it does not let the model judge the bare message. The system first gathers external context with dedicated tools, including URL redirection chains, domain history, screenshots, and brand information, and only then runs the reasoning that produces the verdict. The authors report 98.8% accuracy on 1,200 messages and are explicit that the context-gathering step is what makes the system work, because an SMS on its own is too short to carry the context security reasoning needs.

So the defensible claim is narrower. Strong LLM phishing systems check link-adjacent context because the surrounding system was deliberately built to gather it with tools. A bare chat with a pasted link has none of that machinery.

There is also a reverse risk. In July 2025 Netcraft asked a GPT-4.1-family model where to log in to 50 brands; 34% of the domains it suggested were not controlled by the brand, most of them unregistered, parked, or inactive, and so available for an attacker to claim. In a separate case Perplexity offered a phishing page as a bank's login. An assistant can recommend a phishing URL as well as fail to spot one.

For a person who received a suspicious link, the first-line advice is short. Don't open it in a normal browser. Check it on VirusTotal (virustotal.com) or Google's Safe Browsing site-status page (transparencyreport.google.com/safe-browsing/search), and treat a clean result as "nothing known yet", not as proof of safety, because scanners get cloaked too. If the message claims to be from your bank, contact the bank through the number or reporting address on its own website, never through the message. In Estonia, phishing can also be reported to CERT-EE at the Information System Authority (RIA). At work, send it to your security team.

Before sharing a URL with any public tool, strip private tokens: session IDs, document IDs, email addresses, phone numbers, and campaign tracking parameters. VirusTotal shares submissions with partners and the community.

Use an LLM as an explanation layer, not a scanner. It is good at walking through the visible red flags in a message or a screenshot. Ask it to say which sources it actually checked and which it could not reach. "I could not verify this" is a useful answer.

If someone does use an assistant, the responsible prompt treats the task as triage and does not pretend the model has access it lacks. It should check what a web-enabled chat can actually reach: URL syntax, brand and domain mismatch, redirect behavior, RDAP registration pages and public reports via search, and whether the page asks for credentials or payment. It should state plainly that blocklist and multi-engine reputation verdicts come from services such as Safe Browsing and VirusTotal that a chat assistant does not call on its own, and whose results it cannot reliably read, and say explicitly when a source could not be accessed. Gather the security signals with purpose-built tools first, then let the model reason over them.

The reply's caveat was right: results depend heavily on model and mode, and a capable user can get useful context out of a web-enabled assistant. The generalized claim that LLMs check domain age and public reviews for pasted links holds only under conditions the popular advice omits, and the cloaking objection applies even when those conditions are met: a single model fetch of a suspicious URL can be served a decoy, because cloaking is designed to defeat single-vantage-point checks. The advice should stop treating ChatGPT as a scanner and start treating it as what it is: a good explainer of evidence gathered by better tools.