# 🔗 URL Analysis

## 📝 The Raw Link
`http://www.paypal.com.secure-login-updates.xyz/login.php`

## 🕵️‍♂️ Investigation Steps

### Step 1: The Root Domain
* **Reading**: Read from Right to Left.
* **TLD**: `.xyz` (Cheap, often malicious).
* **Domain**: `secure-login-updates.xyz`.
* **Subdomains**: `www.paypal.com`.

### Step 2: Homoglyphs
* Look closely at: `pаypal.com`.
* The 'a' might be a Cyrillic character (IDN Homograph Attack). Use a "Punycode Converter" to check.
* Real: `paypal.com`.
* Fake: `xn--pypal-4ve.com`.

### Step 3: Sandboxing
* Paste the URL into **UrlScan.io**.
* Look at the screenshot. Does it look like the real PayPal login page?
* If yes, it is a credential harvester.
