4 ms·
You can also go after their ssl certificate provider if they have one. Doesn’t always work but it has at least once for me. Unfortunately I’ve also observed a
by Scoundreller 3y ago
You can also go after their ssl certificate provider if they have one. Doesn’t always work but it has at least once for me.
Unfortunately I’ve also observed a lot of Canadian phishing links will geo-redirect, so reporting them can sometimes go nowhere unless the checker uses the right vpn.
- ghostpepper 3y agoThey almost all use LetsEncrypt, which has a documented policy of not terminating accounts for spam/fraud.
- voz_ 3y agoGross. Why?
- thephyber 3y agoThey have a published policy that explains it: https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html
- fullspectrumdev 3y agoBecause it’s not their problem and would set a bad precedent
- Scoundreller 3y agoTheir arguments are the same that any other layer involved could use to sit it out. “We shouldn’t be the police, let some layer above or below us be the police, just anyone but us!” What they don’t really say is that an abuse team costs money to run. When self-regulation doesn’t work, you risk ending up with legally-imposed regulation. I’m sure that will really delight them.
- quags 3y agoSsl is like the lowest on the chain. You have the domain registrar and the end host and perhaps cloudflare in the middle - and for phishing the mail starting point. All of these are better choices to report abuse than let’s encrypt provided free ssl that’s open for any one to use. I would place that at the level of a phishing site using nginx who could realistically add code to block a list of phishing domains somewhere in their code because it might be used by phishing sites - just no.