Why the weird brackets?

Throughout Phish Flash you'll see web addresses written in an odd way, like hxxps://paypa1[.]com. This is called defanging, and it's done on purpose.

The brackets around the dot and the extra x in hxxp are the safety. Put a normal dot back and undo the hxxp and you'd be left with a real, clickable link to a lookalike of PayPal — notice the digit 1 standing in for the letter L. Printing a live, clickable link to a malicious lookalike is exactly what we want to avoid — even here, on the page explaining it. So everywhere in Phish Flash, risky addresses are shown defanged:

• It makes the link inert — if it's ever pasted into a browser or a chat, nothing loads and nobody lands on a malicious site.
• It's the standard convention security teams use everywhere — threat reports, tickets, IOC feeds. Getting fluent in reading it is itself a useful skill.

Read them as normal addresses. The brackets aren't part of the real name — paypa1[.]com just means that same address with the dot filled back in. Tools like VirusTotal and URLScan accept the defanged form directly, so you can copy a value straight from a card into them without ever un-defanging it yourself.