The attacker notes the TTL of the record that is returned.

Here, we find that TTL suppression in mice causes perinatal death.

That's because the DNS resolver itself has a TTL associated with its DNS record.

The TTL received for a given hostname varies each time the DNS lookup is performed.

First, the TTL interval of phishing sites is small, so there is no time to patch.