reported by 93m4qau783@gmail.com in bug 799676 ...

<quote>
UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce the problem:
1. Open http://www.chromium.org on a hotel or coffee shop network.
2. Get a popup from chromium.org telling you that you have a virus and to download a program to remove it.
3. Accept it, and download the malware offered.
4. Let your files be encrypted with ransomware.

What is the expected behavior?
Chromium.org uses strict HSTS and is not available in insecure HTTP.

What went wrong?
Chromium.org is available in insecure HTTP, which is extremely susceptible to main-in-the-middle (MITM) attacks which could lead to data interception and tampering, including injection of malicious code.

Did this work before? N/A 

Chrome version: 63.0.3239.132  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: 

HSTS for the Entire Internet
</quote>

also: "http://chromium.org redirects to HTTPS but http://www.chromium.org does not."