Percentage-based URL encoding plus Google domain trickery is helping malicious emails to evade filters. A phishing campaign that takes advantage of Google’s ability to decode non-ASCII URL data ...

New phishing campaigns attempt to evade detection by constructing rogue QR codes with special ASCII characters and load phishing pages locally using the local blob URL feature in browsers.

and the web server will receive the URL encoded text and decode it to the characters (including the hidden ones). Those can then be revealed using ASCII Smuggler. The Unicode standard defines the ...

One answer is Punycode, which is a way to represent Unicode characters in ASCII. However, while you could technically encode the raw ... Of course, to prevent regular URLs from being interpreted ...

and not all clients can handle non-ASCII characters. You don't need to worry about Google: you won't get a "duplicate URL" penalty (if that's even still a thing) for a URL-encoded vs non-encoded ...