Comment by cdesai

How can they do that with HTTPS though?

HTTP sure they can happily MITM and redirect, but with HTTPS you need a valid cert.