Comment by hyperpower

You are missing something about HTTPS: you can't produce a valid certificate for the site you're trying to impersonate, and therefore users would notice.

HTTPS operates on the assumption that DNS is insecure.