Payment links arrive from everywhere — clients, freelancers, marketplaces, DMs, email. One click on a lookalike PayPal link can drain a wallet or steal credentials. Existing link checkers are generic; none tie the check to the actual payment rails.
PayShield is a one-box web app: paste any payment link and it runs three check layers before you pay.
- URL structure checks — IP-literal hosts, @ tricks, deep subdomains, punycode, suspicious TLDs, URL shorteners, embedded redirects, TLS validity.
- Brand-impersonation checks — Levenshtein typosquat detection against payment brands (paypa1.com, paypal-secure.co and friends) plus an official-domain whitelist.
- PayPal sandbox verification — for PayPal links, the app calls the PayPal sandbox REST API to confirm the invoice/order actually exists in the sandbox (invoice lookup + order validation). A link dressed up as PayPal with no sandbox record is flagged Danger.
An AI explainer (DeepSeek via Otari) writes a one-paragraph plain-language explanation of each verdict and classifies borderline cases the heuristics can't decide. Deterministic checks decide the verdict; the AI explains it — never a black box. Every verdict lists the exact checks that fired.
Try it in one click: the demo has sample links — a real PayPal.me link (SAFE) and lookalike links (DANGER). No login, no tracking, no real money moves anywhere in the demo.
Honest limits (stated in the app and the repo): sandbox checks only prove things inside the test environment — they cannot verify a real-world merchant or a third-party invoice. There is no public API that resolves an arbitrary paypal.me handle to an account owner, so for paypal.me links we verify the domain is genuinely paypal.me and show the handle; we never claim to verify the recipient. This is a risk check, not a guarantee.
How PayPal is used
PayPal sandbox REST API is central to the product: invoice lookup (GET /v2/invoicing/invoices/{id}) and checkout-order validation (POST /v2/checkout/orders) run against the sandbox for every PayPal link, and the sandbox result is part of the verdict. A pure URL checker without the PayPal call would not meet the brief — the sandbox check is what ties the verdict to the payment rails. All PayPal calls are sandbox-only; no real money, no live credentials.
AI / tools used
- AI: DeepSeek (deepseek/deepseek-v4-flash) via Otari — plain-language verdict explanations + borderline classification.
- PayPal: PayPal Developer Platform, sandbox environment (REST API: Invoicing + Checkout Orders).
- Stack: Python 3 stdlib only (zero dependencies), single static HTML page. Hosted on Render free tier.
- Video: narration via Meta Shortwave TTS (Helio voice), edited with ffmpeg.
