Assuming they're not doing anything weird with Unicode, the evil pi is probably ...

		notriddle on Sept 28, 2018 \| parent \| context \| favorite \| on: Found hooked up to my router Assuming they're not doing anything weird with Unicode, the evil pi is probably running its own DNS server, intercepting the traffic intended for normal DNS, and basically creating its own TLD the same way you would normally do localdomain. The evil.com part is redundant.

Sure, that's a totally different scenario than tricky-looking urls.