How common is usage of Cyrillic text in domain spoofing?

If I am being honest, I thought IDN homograph attacks were made up as some sort of hazing/initiation into cybersecurity prank. Turns out I was wrong.

Are these attacks common? Has anyone had an incident as the result of one? I am wondering if I should add a check for Cyrillic text in domain names when reviewing emails flagged as phishing.

attacks check cybersecurity domain domain spoofing idn incident result sort spoofing text thought wrong