Nice build - the "skeletonize both sides" reminder is the part people usually get wrong. Two upgrade paths worth knowing for anyone extending this: first, instead of hand-maintaining the CONFUSABLES subset, the dict can be generated at build time from the official confusables data file behind UTS #39 - the full table covers thousands of entries, including Armenian and Cherokee lookalikes that a hand-picked Cyrillic/Greek subset misses, and the runtime stays stdlib-only. Second, this checker gets much more powerful pointed at a live feed: running it against newly issued certificate names from Certificate Transparency logs is a common way to catch lookalike registrations of your own brand within hours, before the domain ever sends a single phishing email. The exit-code-per-batch design makes that an easy cron job. Rating edit distance 1 as MEDIUM is also the right call - short brand labels have too many legitimate neighbors for auto-blocking.