Unicode / overlong / homoglyph
Filters that work on UTF-8 after they already made a decision on bytes, or that treat lookalike domains as the allowlist host.
Tags: unicode, waf, redirect, ato
Controlled probes
%C0%AE%C0%AE (overlong dot)％2e％2e％2f (fullwidth)target.com。evil.examplexn-- (punycode host)adminexe.js (RTL override in a filename)
Source: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Unicode