This is the same problem we've had with Certificate Transparency.
In grad school we looked at integrating CT monitors into web servers that manage certificates for your sites (including monitoring lookalike or spoofy names), but then weren't sure what to do when a suspicious certificate appeared in the logs. Do you email the site owner? Then what? Sure, you can report to CAs and web hosts and all that, but who will actually go to that trouble? By the time you do that, the site will probably already be blocked by SafeBrowsing and whatever other blocklists.
In grad school we looked at integrating CT monitors into web servers that manage certificates for your sites (including monitoring lookalike or spoofy names), but then weren't sure what to do when a suspicious certificate appeared in the logs. Do you email the site owner? Then what? Sure, you can report to CAs and web hosts and all that, but who will actually go to that trouble? By the time you do that, the site will probably already be blocked by SafeBrowsing and whatever other blocklists.