@Palletack known about IDN spoofing for so many years (funny that it is still cyrillic, i thought unicode gave more options) and I was thinking browsers would have added some protection or identification markers for this by now.