4 · Brand-impersonation (MEDIUM). This page shows a PayPal login while served on a non-PayPal domain → fires brand-impersonation. On a real look-alike domain it would be HIGH. Expected console: DETECTION [medium] brand-impersonation: paypal login on non-paypal domain.