Yeah, it’s also a common example for why showing punycode for IDNs is a super bad idea. e.g., take fluege.de (a flight comparison site) and flüge.de (a competi

Yeah, it’s also a common example for why showing punycode for IDNs is a super bad idea. e.g., take fluege.de (a flight comparison site) and flüge.de (a competing flight comparison site). The plain-ascii transscription of ü is ue. Now, flüge.de can’t buy fluege.de, or use that domain, and has no alternative domain. But if you show the punycode version in the URL bar, you just increased the phishing risk significantly, because you’ve trained users to enter their payment data on a xn-randomblabla.de page.