And that’s the thing, thanks to Let’s Encrypt, the padlock on the fake site also stays, everything looks normal.

If you now also register something like accountsgoogle.com or a similar page, people likely wouldn’t even notice.

This is like it’s made for phishing.