This is a plaintext HTTP webpage trying to look like a valid HTTPS, but it's not. If you see a lock 🔒 in the address bar you should get yourself another browser.
Also, the favicon is a lock and <title> contains the emoji lock + fake paypal.com DNS, it can trick some users in tab view (https://twitter.com/chronic/status/886978532508934144).
tl;dr: Unicode/Emoji in URLs are bad and can be dangerous. Chrome, Firefox, IE and Safari seem to be safe.
PoC by @x0rz