Evil Twin Maps the Domains Pretending to Be You

Field notes

The scan combines generated variants with registration, liveness, and MX-record checks, separating domains that can receive email from those that merely exist. It also accounts for Unicode homographs, which can render like ordinary Latin characters while being encoded as xn-- punycode. DNS lookups are described as running in the browser through encrypted DNS-over-HTTPS, and shared results are the point at which the scanned domain may leave the local workflow.