This could be done at the client level using some normalization plus a bit of reputation.

"Did you intend to go to “ápple.com” (suspected malware host), or “apple.com” (100b visitors a year)?