There is (of course) a Tumblr site for sites that do this[0]
I found a bunch of local websites including utilities and email providers that do this[1] and seem completely unaware of the risk. Emailing them to explain the problem didn't help much as the vast majority simply ignored me. Hopefully this will make it into all the mainstream browsers soon because not protecting sensitive data with HTTPS is really inexcusable in 2016. It's not like it costs a lot of money to do.
[0]http://httpshaming.tumblr.com/
And yes I see the irony in having an HTTP site for this, but at least Tumblr does a proper HTTPS form post action...