Meta: It seems that HN lists the Punycode for this website's domain (xn--1-zfa.com), instead of the actual IDN that's displayed by the browser (ä1.com). This feels kind of odd to me. [Punycode] https://en.wikipedia.org/wiki/Punycode [IDN] https://en.wikipedia.org/wiki/Internationalized_domain_name
Modern Browsers sanitize punycode, not so sure about bespoke browsers that live inside other mobile apps