address=/:xn--*:/0.0.0.0
1. Use a browser extension that throws a warning on all unicode domains (maybe even with unicode highlighting). Drawback: Needs to be done per-device.
2. Let your pihole MitM all https traffic with a certificate you do NOT trust (maybe create one per domain, so you can add it to the trusted list); if the connection is over http, upgrade it to https (if the server doesn't speak https, proxy it). Drawback: It's much more complicated, and if your bank happens to be called e.g. "Bank of Zürich" you still need to take a look at the IDN to determine if you're on the right website (or add an exception).
You probably don't want to remove the dots on that one.
Similarly for a power company, http://xn--rsted-uua.dk, just a redirect, but they do use it on adverts and my electricity bill.
Some that don't redirect: http://xn--mgk--jra.dk/ https://www.xn---strm-uuae.dk/ https://xn--magnusbrth-85a.se/
(HN has converted the displayed URLs to Punycode, presumably as a quick security measure without reference to the reasonable characters for each TLD.)
To tell you the truth IDN domains feel like a failure, a gimmick. Their biggest market probably was meant to be countries that don't use the Latin alphabet, and they've failed spectacularly.
If you use Firefox, for your own security, set network.IDN_show_punycode to true.
They seem to be used in Russia a little more, especially with the .рф TLD[1], although many are still just redirects.
I have no idea what the text means, but these sites look reasonable: https://www.xn--80aicstx0byb.xn--p1ai/ http://xn--j1abth1c.xn--p1ai/ https://xn--d1ai6ai.xn--p1ai/
[1] https://en.wikipedia.org/wiki/.%D1%80%D1%84
(HN seems to have translated these to Punycode, presumably a quick security measure without respect for non-ASCII languages.)
so I hacked something together that uses the linux kernel NFQUEUE: https://github.com/DyslexicAtheist/nfq
this way I have guarantee that these domains will never be resolved (which is what I want :))