Could you perhaps look at the IDN spec to see what code-points / ranges they've excluded? There may also be libraries out there that process IDNs, and therefore include anti-spoofing. I'm not quite sure how one would make something accurate without having to paint a broad brush across the unicode space because it's unreasonable for anybody to have to go through the whole unicode space to find untrustworthy symbols.