The site looks identical to the real Washington Post website, except for the fact that it uses a small variation of the real URL

It should be possible to mitigate this sort of attack via some technical methods, like having something that visually indicates in a browser some metric of “prominence” that a given domain has.