I was under the impression that the "s", standing for "secure" & usually bearing a locked padlock symbol, was sacrosanct. I thought those addresses were only given to sites with some sort of certificate. How do fake/scam sites get around this? Or is my understanding mistaken? I ask because if it's easy to do, how are we then supposed to ever trust that "s" anyway? Are the malware writers that good that they can fake whatever certification is required? (lots of questions, I know...). Thanks.