The copycat sites are using valid certificates to be more convincing.
Source: Threadpost