Comment by DyslexicAtheist

if you run pihole or a local dnsmasq/unbound it should be possible to mitigate it by sinkholing any unicode domains, e.g. with dnsmasq (requires a patch https://github.com/spacedingo/dnsmasq-regexp_2.76) you can do this:

  address=/:xn--*:/0.0.0.0

does anyone know if something like this is possible with unbound?