With help from Google, impersonated Brave.com website pushes malware
arstechnica.com
arstechnica.com
I can think of at least one mitigation: have the browser display some kind of prominent indicator or even a warning whenever the URL includes a punycode domain.