> The only real defense is to glance at the url bar every time you're about to enter your password.
With i18n not even that: https://www.theguardian.com/technology/2017/apr/19/phishing-...
Benign POC: https://www.xn--80ak6aa92e.com/ (open it and it'll look like a normal "l" in the url box)