Google-hosted malvertising leads to fake Keepass site that looks genuine
Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.)The only place punycode really gets used are spam domains in practice. Even most Cyrillic and Asian domains don't use punycode.I get the concept of punycode and it is impressive technically but for domains it's just been a massive phishing headache.