Here’s a URL used in one I saw today:
http://www.paypal.com7cgi-bin-webscr-LOGON-ID-LOGON-sec-user241756.gsecure.net.jikao.com.tw/.https://www.paypal.com/
(Don’t go there!)
That’s a long link, it starts with www.paypal.com, and it has words like “secure” in it. But visitor beware: the domain name is jikao.com.tw, not paypal.com!
Reported to Gmail as phishing.