A University of Córdoba website used as SEO bait: 'AI girlfriend' spam exploits the trust in .es domains

By Universidad de Córdoba (UCO) · October 15, 2026.

This material does not contain a news story. The feed headline, «best ai girlfriend apps 2026 best ai girlfriends for iphone list», is not an editorial article. It is a string of keywords that appears linked to the Universidad de Córdoba's domain. We received no article content, only the title and a description that repeats the same thing.

The URL points to the virtual tour page of a university service (SCAI). It includes an `xml=` parameter with base64-encoded data. Once decoded, it appears to be an instruction for the panorama viewer to load an XML file hosted on a GitHub Pages site unrelated to the university. We have been unable to verify what that file contains or who put it there. Nor is there any indication that the UCO has published anything about AI companion apps.

Our take: this fits a well-known SEO spam practice, which involves exploiting poorly validated parameters on legitimate, high-authority pages. This way, junk content, in this case about «virtual girlfriends», gets ranked using the reputation of an institutional .es domain. In general, it is a cheap way to sneak links into search engines. It also serves to redirect anyone who clicks to sites no institution controls.

That is why we are not analyzing the phenomenon of AI virtual partners here; it deserves its own piece with real data. What does remain is a short-term security lesson. A trusted domain does not guarantee trusted content, and anyone administering a website must validate what it accepts via parameters. With AI tools generating this kind of spam at scale, the problem will grow before defenses catch up.