That’s right, Znuff! SSL is not the main issue here. If I make a website like http://billing.paypal.com.updatenow.co What do you think people will fall into trape? It’s not SSL enabled but still convincing.