Attackers will then work to find domain names that generate similar identicons. But maybe the identicons don't need to be meaningful or the same for everyone.

Attackers will then work to find domain names that generate similar identicons. But maybe the identicons don't need to be meaningful or the same for everyone. You could hash the domain with another value, like a computer name or username, then show some interesting pattern. Then it would have a different pattern. Not perfect, but yet another user cue.