Well it's an extremely challenging edge case to address. As noted, mixed alphabet domains have decomposed to their punycodes for a while, but the single alphabe

Well it's an extremely challenging edge case to address. As noted, mixed alphabet domains have decomposed to their punycodes for a while, but the single alphabet case is harder to separate malicious from legitimate. This isn't a full solution yet anyway... a Russian user could still be phished for example, because their locale would match.