When the 'S' in HTTPS also stands for shady