Certified Phishing: Taking a Look at Public Key Certificates of Phishing Websites
summary
Collected nearly 10,000 valid phishing certificates and about 40,000 valid benign certificates and compare issuer, validation type and subject fields. Most sites use domain-validated certs and Let’s Encrypt is the top issuer for both sets, so certificate metadata alone rarely distinguishes phishing from benign. Phishers generally do not recreate target organization or EV fields unless they host on the target’s infrastructure, and deployment issues like TLS interception and certificate transparency limitations complicate detection.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:22Why look at certificates
- 1:21Phishing
- 2:08Certificate Types
- 3:47Research Questions
- 4:33Data Collection
- 12:52Open Questions
- 15:26Conclusion
related talks
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
30mBuilding a Predictive Pipeline to Rapidly Detect Phishing Domains
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
51mDeepPhish: Simulating Malicious AI
42mPhishing With a Net: The NIST Phish Scale and Cybersecurity Awareness
09mPresenting Suspicious Details in User-Facing E-mail Headers Does Not Improve...
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
05mKnowledge and Capabilities that Non-Expert Users Bring to Phishing Detection