ChatGPT sent users to a scam clone of T3 Code. Could it happen to your product?

Last Updated on November 4, 2026 by Ian Naylor

Last night a developer asked ChatGPT where to download T3 Code for his wife. It sent her to t33[.]codes, an almost pixel-perfect clone of the real site, reportedly registered only about two weeks earlier and pushing a crypto scam.

Theo, who makes T3 Code, spent the day digging and posted that ChatGPT recommends the fake “constantly”. His question to everyone was simple: what is causing this?

Nobody outside OpenAI can answer that for certain. But the story is a useful wake-up call for every founder, because the same thing could happen to your product. Here’s what we know about how AI assistants pick which site to send people to, and what you can do about it today.

Why a two-week-old site can beat the real one

A domain that new can’t be in the model’s training data. So when ChatGPT recommended it, it almost certainly came from a live web search run at answer time, not from anything the model “learned”.

That matters. AI assistants with search don’t decide on their own which site is official. They read what a search index returns, then summarise it with total confidence. If a lookalike page ranks for “T3 Code download” in that index, even briefly, the AI can repeat it to thousands of people.

Several developers in the replies pointed at Bing, since ChatGPT’s search has long been reported to lean on it. That’s a hunch worth checking, not a proven cause. Either way, the lesson is the same: AI answers are only as trustworthy as the signals the web gives them.

The signals AI uses to decide who’s “official”

Search engines, and the AI tools built on them, work out which site to trust largely from what the rest of the web says about it. The strongest signals are:

• Links and mentions from relevant, established sites. When real blogs, docs and communities in your niche link to your official domain, they’re vouching for it.
• Consistency. The same name, the same one-line description and the same URL everywhere you appear.
• Age and history. An older domain with a track record usually wins, unless a newer site is pushing hard on the other signals.

A scammer can fake a page in an afternoon. What’s much harder to fake is a set of genuine sites in your niche pointing at you. That is your best long-term defence.

A 15-minute brand check you should run this week

1. Ask the AI tools directly. In ChatGPT, Perplexity, Gemini and Google AI Mode, ask “Where do I download [your product]?” and “What is the official site for [your product]?”. Note every URL they give.
2. Search the same phrases in Bing and Google. If a lookalike domain shows up, report it as phishing (Google Safe Browsing and Bing both have report forms) and to the domain’s registrar.
3. Verify your site in Bing Webmaster Tools as well as Google Search Console, so you can see what Bing thinks your site is about.
4. Make your official URL impossible to miss. Put it in your GitHub README, docs, app store listings, X bio and press kit, written exactly the same way.
5. Grab the obvious typo domains for your brand if they’re cheap. One extra letter was all it took here.
6. Repeat it monthly. New clones can appear at any time.

Build the links that vouch for you

The long-term fix is to make sure the web clearly agrees which site is yours. That means real links from real sites that already cover your topic: guides, comparisons, roundups and guest posts in your niche.

That’s exactly what 3way.social is built for. It’s a community of 14,000+ member sites where you can buy, sell or swap links and guest posts with sites that already rank for your topic, and every deal is checked. The AI Link Finder suggests relevant sites for your pages, so you’re not cold-emailing strangers.

Whether you use us or not, run the brand check above this week. If ChatGPT can send Theo’s users to a fake, it can send yours too.