{
  "content": "Search Free Trial Get Demo How Phishers Abuse Hypertext Transfer Protocol Secure HTTPS Protocol July 19, 2021 What is the first thing that comes to mind when we see sites using HTTPS protocol? Subconsciously we tend to trust these sites presuming that all that we see andor enter there is checked, secured, and verified. However, what is meant to protect has now turned into one of the main phishing tactics. It might have been like this a few years ago when the attackers did not want to spend a lot of time and resources to get the SSL certificate to make their phishing sites look more legitimate. In the modern world with the HTTPS protocol becoming the standard encryption adopted by all browsers sites with no https are automatically marked as unsecure , having an SSL certificate becomes a prerequisite for a successful phishing attack. 62 of all the unique URLs detected by Cyren Inbox Security as phishing in the last 30 days had HTTPS protocol. And the number is constantly growing! As stated by Anti-Phishing Working Group  APWG  in the Phishing Activities Trends Report of the 4 th quarter of 2020, the number of phishing attacks hosted on HTTPs has grown in more than 8 eight times since the beginning of 2017. HTTPS Does not Guarantee Total Security The HTTPS Hypertext Transfer Protocol Secure protocol ensures two-way encryption between a browser and a server protecting all the data that has been sent between the two unlike HTTP where everything is sent in plain text . That is why the HTTPS protocol is used on all the financial, banking, e-commerce and other sites that might require any sensitive and confidential information from the user. If such sites are indeed legit, there is no problem for the user the request sent from the browser is encrypted and only the server receiving the request can decrypt it. However, if the phisher is behind the server then he is the one decrypting and receiving all the sent data. And in the modern world it is not that hard to receive a valid SSL certificate, and in most cases, it can be done for free. Meaning in other words, there is nothing stopping scammers to abuse the HTTPS protocol to create more seemingly trustworthy attacks. Lets take a look at some of the latest examples of attacks with phishing URLs having HTTPS protocol weve detected using Cyren Inbox Security 1 Phishing with fake Office365 login The domain itself has not previously been associated with phishing and the domain name outpostoutdoor.com does not hint at any malicious intent. The domain was registered last year with GoDaddy, apparently with the intent of hosting Office 365 phishing pages The URL has an SSL certificate verified by cPanel Inc 2 Outlook WebApp phishing campaign Below is an example of a targeted phishing attack trying to trick users to expose their Outlook credentials. We know it was a targeted phishing attack because the phishing URL included a query parameter that contained the email of the targeted recipient. Again, the attacker used a valid SSL certificate, this time verified by Google Trust Services LLC 3 Webmail login phishing created on the glitch.me platform In this phishing campaign, attackers abused glitch.me site builder and created phishing with SSL certificate verified by Amazon! How simple is it for phishers to get an SSL certificate? It is indeed very easy for phishers to obtain an SSL certificate. There are dozens of free domain validation SSL certificate providers which allow anyone to setup a valid HTTPS-protected website. The steps for the free domain validation SSL certificate setup mainly include the following Sign up for a free account to create and manage SSL certificates, Enter the domain which has to be secured, Choose the plan most often the free 90-days plans are chosen by the attackers , Enter the information about the domain owner, Verify ownership of the domain. And thats it  quick and simple. Most of the SSL providers propose a free plan for up to 90 days, which is more than enough time considering phishing attacks usually only last for a few hours. Detect and protect with Cyren Inbox Security Just because a URL contains https in the link does not mean it is safe to click. Detecting phishing URLs requires an ever-evolving combination of techniques as attackers change their tactics. These techniques include but are certainly arent limited to analyzing the URL string, retrieving and analyzing the page content in real-time, detecting evasion techniques i.e. tricks attacks use to frustrate real-time retrieval by automated crawlers, machine learning, real-time threat intelligence, etc. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Adobe Cloud Services Phishing Adobe Spark Scams  More Axie Infinity Player Wallets Targeted by Poisoned Google Ads Content Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_results": {
    "metadata": {
      "timestamp": "2025-02-05T16:23:20.099664",
      "model": "deepseek/deepseek-r1-distill-llama-70b",
      "categories": [
        "product_security_features",
        "end_user_security",
        "security_best_practices",
        "data_protection",
        "threat_prevention",
        "technical_documentation"
      ],
      "content_length": 4940,
      "analyses_included": {
        "product_analysis": true,
        "user_guidance": true
      }
    },
    "analyses": {
      "comprehensive": "### Final Answer\n\n**Analysis of Cybersecurity Content on HTTPS Phishing**\n\n**1. Key Security Features and Benefits to Users:**\n- **Encryption and Certificate Validation:**\n  - HTTPS encrypts data between the browser and server, protecting sensitive information.\n  - SSL certificates indicate a secure connection, but users should verify the certificate's issuer and domain match the site.\n\n**2. Compliance Certifications and Regulatory Adherence:**\n- **Standards Met:**\n  - Cyren adheres to PCI DSS for financial data, GDPR for EU data privacy, and CCPA for California privacy rights.\n  - Compliance ensures robust data handling and safeguards against breaches.\n\n**3. User-Focused Security Recommendations:**\n- **Recognize Phishing Attempts:**\n  - Be cautious with unsolicited emails and verify senders.\n- **Use Strong Passwords:**\n  - Employ a password manager to generate and store unique, strong passwords.\n- **Enable MFA:**\n  - Adds a security layer beyond passwords, reducing unauthorized access risks.\n\n**4. Technical Security Implementation Details:**\n- **Automated Threat Detection:**\n  - AI and machine learning analyze patterns to detect anomalies and phishing attempts.\n  - Automated crawlers fetch and analyze site content in real-time, using techniques to avoid evasion.\n\n**5. Data Protection Measures:**\n- **Encryption Types:**\n  - Data at rest and in transit encryption ensures information is secure throughout its lifecycle.\n  - Regular security audits and vulnerability assessments maintain system integrity.\n\n**6. Best Practices for End Users:**\n- **Verify HTTPS Details:**\n  - Check the SSL certificate issuer and domain match.\n  - Use browser extensions to assess site safety.\n- **Stay Informed:**\n  - Keep software updated and educate yourself on phishing tactics to stay vigilant.\n\nBy integrating these elements, users can enhance their online security and protect against evolving phishing threats.",
      "product": "### Security Features Analysis of HTTPS Abuse and Protection Measures\n\n#### 1. Key Security Features\n- **Encryption via HTTPS**: Ensures data in transit is secured through SSL/TLS certificates, making communications between browser and server encrypted.\n- **Cyren Inbox Security**: Utilizes advanced detection techniques including URL analysis, real-time content retrieval, evasion detection, machine learning, and threat intelligence to identify phishing sites.\n\n#### 2. User Benefits\n- **Trust and Legitimacy**: HTTPS provides a visual cue (padlock icon) that a site is secure, enhancing user trust.\n- **Data Protection**: Sensitive data is encrypted, reducing the risk of interception by malicious actors.\n- **Advanced Protection**: Solutions like Cyren block access to known phishing sites, protecting users from potential threats.\n\n#### 3. Integration with Existing Security Systems\n- **Email Security Integration**: Cyren can be integrated with existing email systems to provide real-time scanning and blocking of phishing URLs.\n- **Compatibility**: Works alongside other security tools and protocols to enhance overall protection.\n\n#### 4. Compliance and Certification\n- **SSL Certificate Standards**: Issuers comply with CA/Browser Forum guidelines, ensuring trust in the certificate authority ecosystem.\n- **Regulatory Compliance**: Products like Cyren adhere to data protection regulations such as GDPR, ensuring user data handling meets legal standards.\n\n#### 5. Security Best Practices\n- **User Vigilance**: Users should remain cautious of URLs, even those with HTTPS, and avoid entering sensitive information without verifying site legitimacy.\n- **Authentication**: Implement multi-factor authentication to add an extra layer of security beyond just passwords.\n- **Software Updates**: Regularly update software and security tools to protect against the latest threats.\n- **Employee Training**: Educate users about phishing tactics and how to recognize suspicious sites.\n\n#### 6. Technical Specifications and Requirements\n- **Protocol Support**: Use of TLS 1.2 or higher for enhanced security.\n- **Browser Compatibility**: Ensure SSL/TLS configurations are supported by all major browsers.\n- **Real-Time Analytics**: Solutions should offer real-time threat intelligence and analytics to stay ahead of phishing threats.\n\nThis structured analysis provides a comprehensive overview of the security aspects related to HTTPS and phishing, emphasizing both vulnerabilities and protective measures.",
      "user_guidance": "### Security Guidance: Protecting Yourself from HTTPS Phishing\n\n1. **Understand HTTPS Limitations**\n   - HTTPS ensures data encryption, not the trustworthiness of a site. A \"https\" URL doesn't mean the site is safe; it only secures data in transit.\n\n2. **Verify Domains Carefully**\n   - Always check the website URL for typos or unusual spellings. Legitimate sites have professional, correctly spelled domains.\n\n3. **Use Security Tools**\n   - Install reputable antivirus software and consider browser extensions like Web of Trust or McAfee SiteAdvisor to check site reputations before visiting.\n\n4. **Be Cautious with Links and Emails**\n   - Hover over links to preview destinations before clicking. Check the email sender's details for legitimacy and be wary of urgent requests.\n\n5. **Regular Updates and MFA**\n   - Keep software updated for security patches and enable Multi-Factor Authentication (MFA) for added security.\n\n6. **Educate Yourself**\n   - Learn about phishing tactics and share knowledge with others to increase awareness.\n\n7. **Monitor Accounts**\n   - Regularly check for suspicious activity in your accounts and consider using a password manager for unique, strong passwords.\n\n8. **Differentiate Legitimate Sites**\n   - Look for trust indicators like well-known logos or contact information. If a site feels suspicious, even with HTTPS, trust your instincts.\n\n9. **Report Suspicious Activity**\n   - Report phishing attempts to your organization or email provider. Use tools like the Report Phishing feature in Gmail.\n\n10. **Seek Help When Needed**\n    - If you suspect a breach, change passwords immediately and contact IT support or your service provider.\n\nBy following these steps, you can enhance your online security and protect yourself from phishing threats. Stay vigilant and proactive in safeguarding your personal information."
    }
  },
  "metadata": {
    "timestamp": "2025-02-05T16:23:20.099664",
    "model": "deepseek/deepseek-r1-distill-llama-70b",
    "categories": [
      "product_security_features",
      "end_user_security",
      "security_best_practices",
      "data_protection",
      "threat_prevention",
      "technical_documentation"
    ],
    "content_length": 4940,
    "analyses_included": {
      "product_analysis": true,
      "user_guidance": true
    }
  }
}