You are missing something about HTTPS: you can't produce a valid certificate for the site you're trying to impersonate, and therefore users would notice. HTTPS

You are missing something about HTTPS: you can't produce a valid certificate for the site you're trying to impersonate, and therefore users would notice. HTTPS operates on the assumption that DNS is insecure.