The "Valid does not mean safe" section is the part that maps directly onto something I ran into building a typosquat detector. My tool flags lookalike domains using WHOIS registration age plus Levenshtein distance on the domain string, which works fine for the common case (paypa1.com vs paypal.com) but is completely blind to confusable/homograph domains, since a Cyrillic character standing in for a Latin one produces two different code points that read as unrelated strings to a naive edit-distance comparison, even though they're visually identical.

Your point about comparing the A-label used for DNS against what's actually shown to the operator is the piece I was missing. Right now my tool only ever sees the raw domain string, it never normalizes through IDNA first or runs it against UTS #39 confusable detection, so an xn-- punycode homograph domain would just look like an unrelated string with a high edit distance and pass right through unflagged.

For anyone else running into this: confusable_homoglyphs on PyPI does exactly this kind of detection (built off the Unicode Consortium's own confusables data), though it looks unmaintained at this point. homoglyphs (by orsinium) seems to be the more current option, positions itself as a more configurable successor to the same idea.

(For context, the tool I mentioned: github.com/Furqan-Ashraf/Typosquat-detector, if it's useful as a reference for the WHOIS-age side of detection.)