This should not have happened.

Look at the URL bar. Click on the URL bar.
You might think you're on simon.com, but you're not.

Your browser can turn a Punycode address into a convincing Unicode lookalike.

Punycode address

xn--smon-08b.com

Browser display (Unicode)

sɨmon.com

This is not simon.com.

The second character is ɨ (U+0268), not i. Both forms above identify the same registered domain.

A massive phishing disaster waiting to happen.

The automatic rewrite hides the obvious xn-- prefix and replaces it with a name that can pass for a site you trust.