"In the third quarter of 2017, we noticed that almost a quarter of all phishing sites were hosted on HTTPS domains, which is almost double the percentage we saw in the second quarter."
"A year ago, less than 3% of phishers used websites that had SSL certificates. "Two years ago, that number was less than one percent." said the PhishLabs administrator, Mr Crane Hassold.
The reasons behind this change they are enough. Phishers often deface pages to host phishing attacks, and it stands to reason that with an increase in legitimate HTTPS domains there should also be an increase in compromised HTTPS pages.
Today, too, it is much easier, faster and cheaper to obtain SSL certificates. So the scammers are taking advantage of the situation to equip the e-fishing domains they use with HTTPS.
"Although the vast majority of SSL certificates used in HTTPS phishing attacks are obtained for free from services such as Let's Encrypt or Comodo, their use is notable because technically, they are not necessary to create phishing websites."
"Without an SSL certificate, the phishing site would still be working as planned," says Hassold.
“So why do scammers bother creating an HTTPS page when they don't really need to? The answer is because phishers believe that the 'HTTPS' designation makes a phishing site look more legitimate to potential victims and therefore more likely to lead to a successful outcome. And unfortunately, they are right.”
Many users do not know that the presence of HTTPS only means that the communication between the proletterof browsing and the website is encrypted. They believe that seeing the green padlock and HTTPS before a domain name means that the website itself is safes (ie. Safe to use = legal).
The fact that browsers like Google Chrome showing pages with SSL certificates as “Secure” in the URL bar does not help eliminate these attacks.
