DNS substitution is rare. using non-latin symbols which look exactly like latin is more often. Like... binance, binance or binance - all three words here are written phishing-style, but you can't tell them from binance (that one is right).