[LargeTomato]

My android phone was redirected to an https endpoint.

[entropyie]

If the first request is plaintext, the request can be intercepted before you ever get the redirect, inserting a trojanised login page instead.