🔒 paypal.comThis is a plaintext HTTP webpage trying to look like a valid HTTPS, but it's not. If you see a lock 🔒 in the address bar you should get yourself another browser. Also, the favicon is a lock and <title> contains the emoji lock + fake paypal.com DNS, it can trick some users in tab view (https://twitter.com/chronic/status/886978532508934144). tl;dr: Unicode/Emoji in URLs are bad and can be dangerous
