Hallucinating for Fun and Profit: Using LLMs to Find Lookalikes without Targets

Infoblox describes a scalable approach for detecting lookalike domains by pairing LLM-generated target identification with traditional techniques (e.g., modified edit distance), and contextual verification via WHOIS/registration and TLS certificate data to minimize false positives. The report highlights limitations of LLMs (hallucinations, variable confidence), shows recent suspicious domain examples, and notes near-term integration into Zero Day DNS detections and the Infoblox Dossier feature to better protect customers from phishing and impersonation threats.