I assume you guys know about international languages bug in URLs, but didn't see anything else on it...
http://www.shmoo.com/idn/
Even effects SSL!
If anyone cares...
Corestreet just released an updated version of their SpoofStick to address this IDN issue. I've attached a small pic to show how it's showing the true domain while the address bar says paypal.com.
http://www.corestreet.com/spoofstick/
<<inline: paypal.png>>
