Another example is xn--e1awd7f[.]com which decodes to еріс[.]com to the user. The real epic[.]com is a healthcare site. Users of Firefox will not know the difference until they land on the suspicious parked site. Some browsers are trying to block known bad punycode sites or at least not decode them. It's all very shady and I can't rely on my users to recognize this type of obfuscation. Please allow us to block all punycode domains as Scott requested in April of 2021.

Also, I request an option to block punycode TLD. There are 152 of them right now according to iana.org (data.iana.org/TLD/tlds-alpha-by-domain.txt ) I'm using the universal policy to block them for now but in a few years, who knows how many there will be. Would be a shame to fill my filter policy with nothing but Punycode TLD blocks.