Why the weird brackets?

Throughout Phish Flash you'll see links written in an odd way: hxxps://paypa1[.]com instead of https://paypa1.com.

This is called defanging, and it's done on purpose:

• The brackets and the hxxp make the link inert — if it ever gets pasted into a browser or chat, nothing loads and no one ends up on a malicious site.
• It's the standard convention security teams use everywhere — threat reports, tickets, IOC feeds. Getting fluent in reading it is itself a useful skill.

Read them as normal links. The brackets aren't part of the real address —paypa1[.]com just means paypa1.com. Tools like VirusTotal and URLScan accept the defanged form directly, so you can copy a value straight from a card into them.