Human Judgment Hacks: How Lookalike Domains Work

This report analyzes lookalike domain attacks—phishing and impersonation techniques that exploit human cognitive shortcuts rather than technical vulnerabilities—describing their anatomy (homographs, typosquatting, domain embedding), attacker tradeoffs (plausibility, aging, reuse, ambiguity), and how passive DNS can be used as an early sensor of social targeting intent while acknowledging DNS limitations for definitive attribution or impact measurement.