But what about HSTS and HSTS preloading? This sounds more like a deauth/captive portal phish to me.