It will never use HTTPS, so by visiting it, you allow the man-in-the-middle to do its thing, and show you a log-in page or whatever.