The only obvious defense, for registrants who want their customers to arrive reliably at their website, will be defensive registrations.  Lots of defensive registrations.  (I did a quick calculation for Citi Bank.  4 letter domain name.  Close to 300 readily confusable variations.  Longer names would have more, of course.)