Rating edit-distance-1 as MEDIUM and leaving it to a human is the right call. The question for that human usually isn't "does this look like our brand", since check() already answered that. It's "does this name exist and do anything". A MEDIUM that isn't registered is a note for later. One registered last week with MX records and a certificate is something to act on today.

That part needs live data, so it can't sit in a stdlib-only script. For the review step you can query RDAP for the creation date (rdap.org redirects to the right registry) and run dig MX, or use something that bundles both. We built Ask WhoisFreaks for this kind of one-off question (I work on it): "is paypa1-support.com registered, and is it on any threat feed?" gets WHOIS, DNS, SSL and feed results in one answer. It's a chat tool, so for scoring every MEDIUM inside CI you'd want an API call instead.