security none existsnt. Aws security tools used to scream at you every time you open the aws console. Solution at the company was to restrict views to those pages so (most) people don’t see the security/vuln reports. To get reports, you’d have to ask cybersec.
Not going to lie, that is hilarious. And forget red flags, you have a whole squadron of semaphores right there.
Some TLDs don’t allow full unicode either. Country TLDs usually just add their own special chars, for example .se (sweden) allows åäö.
The whole thing has a name as well: https://en.wikipedia.org/wiki/IDN_homograph_attack