Load the live phishing page at https://wwwxn--bbox-vw5a[]com/login (that link has been hobbled on purpose) in Google Chrome and you’ll get a red “Deceptive Site Ahead” warning Load the address above — known as “punycode” — in Mozilla Firefox and the page renders just fine  at least as of this writing