He's referring to the fact that the domain isn't PayPal - instead of slashes to separate directories, the .s just continue the domain name to something in Hong Kong. A lot of people would miss that, they'll just see the paypal.com and think it is legitimate.