On Tuesday, March 3, 2015, researchers disclosed a new SSL/TLS vulnerability — the FREAK attack. The vulnerability allows attackers to intercept HTTPS connections between vulnerable clients and servers and force them to use ‘export-grade’ cryptogrpahy, which can then be decrypted. There are several posts that discuss the attack in detail: Matt Green, The Washington Post, and Ed Felten.

A connection is vulnerable if the server accepts RSA_EXPORT cipher suites and the client either offers an RSA_EXPORT suite or is using a version of OpenSSL that is vulnerable to CVE-2015-0204. Vulnerable clients include many Google and Apple devices (which use unpatched OpenSSL), a large number of embedded systems, and many other software products that use TLS behind the scenes without disabling the vulnerable cryptographic suites.

This site focuses on tracking the impact of the attack. See below for:


The FREAK attack was originally discovered by Karthikeyan Bhargavan at INRIA in Paris and the mitLS team. Further disclosure was coordinated by Matthew Green. This report is maintained by computer scientists at the University of Michigan, including Zakir Durumeric, David Adrian, Ariana Mirian, Michael Bailey, and J. Alex Halderman. The team can be contacted at zmap-team@umich.edu.


What servers are affected?

Websites that support RSA export cipher suites (e.g., TLS_RSA_EXPORT_WITH_DES40_CBC_SHA) are at risk to having HTTPS connections intercepted. In order to track the impact of the FREAK attack, we have been performing scans of the IPv4 address space and completing TLS handshakes with responsive shots. In these handshakes, we only offer RSA export suites. We have posted a list of Alexa domains that support any RSA export cipher suites at the bottom of the page bottom of the page.


Alexa Top 1 Million12.2%
Browser Trusted Sites36.7%
Full IPv4 Address Space26.3%

What should I do?

If you run a web server, you should disable support for any export suites. However, instead of simply excluding RSA export cipher suites, we encourage administrators to disable support for all known insecure ciphers (e.g., there are export cipher suites protocols beyond RSA) and enable forward secrecy. Mozilla has published a guide and SSL Configuration Generator, which will generate known good configurations for common servers. You can check whether your site using the SSL Labs' SSL Server Test.

Alexa HTTPS Sites that support RSA Export Suites

The following websites in the Alexa Top 10K support RSA Export Suites as of Tuesday, March 3, 1:00 AM EST. We urge these sites to drop support for export suites. The full list of domains is available here.


Alexa RankDomainAddress Tested
27sohu.com123.125.116.19
182businessinsider.com64.27.101.155
234ppomppu.co.kr110.45.151.212
243smzdm.com114.113.158.226
247americanexpress.com23.13.171.41
251jabong.com23.203.7.176
273groupon.com184.26.49.170
290bloomberg.com69.191.212.191
4424shared.com208.88.224.136
448npr.org216.35.221.76
519hatena.ne.jp59.106.194.19
615instructables.com74.50.63.27
629airtel.in125.19.135.93
649kohls.com23.202.240.45
767adplxmd.com205.186.187.178
795mit.edu23.202.254.127
799tinyurl.com23.220.249.147
808suning.com122.228.85.93
820saramin.co.kr182.162.86.29
891vi-view.com50.97.32.135
903itau.com.br23.38.106.190
951huaban.com115.238.54.162
959zomato.com54.151.251.33
960nationalgeographic.com74.217.81.233
999marriott.com23.45.45.5
1001jobrapido.com46.105.106.82
1029forever21.com23.202.233.118
1089wiocha.pl195.225.138.234
1150axisbank.com119.226.139.40
1180clarin.com200.42.136.212
1236mgid.com208.94.232.200
1247jcpenney.com23.49.180.228
1261wowhead.com23.199.195.58
1297gaana.com223.165.30.26
1313mtime.com59.151.32.20
1360refinery29.com50.22.34.136
1361vente-privee.com185.45.180.3
1364ynet.co.il192.115.80.55
1383dhgate.com124.42.15.198
1411vesti.ru80.247.32.206
1424adxcore.com188.165.36.101
1456sweet-page.com50.97.32.133
1484binaryprofessional.com50.7.157.122
1502globososo.com184.173.140.162
1571estadao.com.br23.199.200.37
1573jcrew.com23.37.8.44
158617173.com220.181.90.240
1599bmi.ir89.235.64.67
1620zdnet.com50.112.160.88
1628jugem.jp210.172.182.89
1646accountonline.com192.193.200.101
1662umich.edu141.211.243.44
1680cornell.edu128.253.173.241
1684lg.com165.244.62.23
1693uludagsozluk.com188.132.225.181
1722yixun.com111.30.131.20
1738priceminister.com212.23.167.62
1856ibtimes.co.uk64.147.114.55
1860extra.com.br23.221.0.145
1864jiameng.com117.78.2.204
1866ihg.com23.202.251.213
1878miui.com42.62.48.148
1902syosetu.com111.64.91.10
1915thrillist.com50.57.33.153
1928dealmoon.com198.23.88.242
1978alice.it217.169.121.227
1986ansa.it194.244.5.206
1995duba.com114.112.93.100
2014leparisien.fr95.131.142.225
2015copyscape.com212.100.239.219
2025ana.co.jp202.224.1.7
2031suumo.jp160.17.3.13
2035unam.mx132.248.10.44
2040aruba.it62.149.188.154
2047gg.com.ua213.227.192.135
2054eltiempo.com200.41.9.39
2064timesjobs.com115.112.206.11
2092mashreghnews.ir94.182.146.23
2106alfabank.ru195.218.200.205
2164pontofrio.com.br23.221.11.242
2170gobizkorea.com211.119.134.217
2185delfi.lt91.234.200.113
2194epnet.com140.234.254.41
2199bigrock.in103.21.58.212
2217ohmyzip.com216.176.192.139
2317indiocasino.com212.64.147.151
2326doctissimo.fr85.116.34.4
2342monsterindia.com220.226.205.30
2377cafe24.com222.122.205.172
2382sedo.com82.98.86.183
2404famitsu.com202.90.182.200
2413lolking.net23.199.195.58
2421jstor.org198.108.24.38
2436literotica.com216.150.65.200
243756.com59.32.213.232
2448incruit.com121.254.160.232
2462tradeindia.com14.140.161.58
2464taikang.com116.58.220.1
2493lvmama.com114.80.83.166
2512keywordblocks.com50.58.197.14
2529itv.com193.35.9.65
2531wannonce.com188.165.15.58
2559rotoworld.com64.210.192.54
2560ponparemall.com160.17.4.128
2593ole.com.ar200.42.93.137
2605ipeen.com.tw60.199.195.197
2631hotelurbano.com107.23.208.36
2659337.com174.36.254.166
2687coolenjoy.net222.237.78.174
2693mafengwo.cn119.254.76.148
2702education-portal.com207.97.195.109
2765beitaichufang.com182.18.17.202
2767dailybasis.com68.169.73.82
2780made-in-china.com72.32.82.237
2796casasbahia.com.br23.221.16.216
2821suntimes.com64.94.90.42
2823talktalk.co.uk62.24.150.2
2843gocomics.com66.6.101.183
2853weathernews.jp211.8.49.106
2863mk.co.kr220.73.139.201
2875cnyes.com211.72.252.30
2879giga.de80.86.80.168
2880www.net.cn42.156.140.7
2897marksandspencer.com23.203.7.229
2901twitcasting.tv202.234.23.144
2955wmmail.ru185.15.210.21
2964infibeam.com180.179.101.143
2975seobook.com207.97.249.100
2995dv37.com218.5.238.175
3102olleh.com183.110.184.90
3113tenpay.com112.90.82.140
3142testberichte.de62.146.104.29
3158motorola.com144.188.128.101
3163sidereel.com173.247.105.225
3280ehanex.com203.251.153.26
3295nsw.gov.au203.3.232.71
3305santander.com.br23.202.248.145
3315usajobs.gov23.13.162.35
3318hola.com62.22.171.50
33441hai.cn222.73.36.200
3366sbicard.com59.144.22.1
3367focus.cn123.126.104.8
33755usport.com113.105.142.200
3385bouyguestelecom.fr84.37.9.183
3415afreeca.com121.125.76.89
3442khan.co.kr203.234.148.252
3449enuri.com124.243.126.244
3451lan.com67.15.147.205
3455wechat.com203.205.142.141
3502jorudan.co.jp210.168.27.165
3515afkarnews.ir5.144.129.189
3526whitehouse.gov23.13.176.110
354219lou.com115.236.99.92
3543yinyuetai.com117.79.131.138
3583rs-online.com80.169.5.117
3604mediaite.com69.60.14.234
3611persianv.com5.144.130.216
3614hypebeast.com50.112.144.237
3618ilmessaggero.it85.18.214.171
3636pc6.com220.162.97.209
3646am15.net95.213.156.90
3653trafficshop.com78.140.142.21
3670kuwo.cn221.238.18.58
3687bankrate.com.cn211.151.169.36
3689marketgid.com87.242.88.80
3731tribalfusion.com204.11.109.195
3759techinasia.com50.97.236.4
3780freemail.hu195.228.245.1
3804delfi.lv62.63.137.6
3849lenskart.com54.254.151.162
3867pcfaster.com180.76.2.25
3914dinodirect.com184.173.225.136
3954gearbest.com50.97.75.179
3981nordstromrack.com23.220.249.107
3982rincondelvago.com198.64.137.53
4021honda.com164.109.25.194
4042cjmall.com210.122.101.150
4072juntadeandalucia.es217.12.24.33
4099standardbank.co.za196.8.136.20
4152dominos.co.in202.87.34.218
4158virginia.edu128.143.22.36
4161backlinkwatch.com74.204.189.20
4178sec.gov23.202.222.140
4247subscribe.ru81.9.34.191
4298nespresso.com91.209.84.237
4300delfi.ee185.20.100.249
4307gingersoftware.com173.231.146.230
4349androidpit.com54.80.50.197
4364ria.com213.95.148.25
4400topshop.com23.221.16.184
4402veoh.com69.167.127.57
4493recruit.co.jp160.17.7.22
4496mamaclub.com61.64.53.205
4533eldiario.es37.46.75.24
4554alriyadh.com89.189.232.23
4563mca.gov.in14.140.191.120
4567linkprice.com222.236.44.131
4599weather.gc.ca205.189.10.44
4615ets.org144.81.88.152
4623funweek.it151.1.71.171
4632ip138.com61.140.13.87
4637virtualedge.com74.205.242.20
4641kaixin001.com220.181.103.141
4661yes24.com61.111.13.101
4666shueisha.co.jp210.133.105.162
4669sofmap.com61.204.171.132
4723pearltrees.com93.184.35.40
4728pearson.com159.182.33.151
4753mzamin.com66.226.79.63
4763nova.cz88.86.114.130
4787gongkong.com59.151.1.94
4793propellerads.com78.140.145.203
4796tamin.ir80.191.79.22
4854entekhab.ir94.182.146.40
4868lefrecce.it23.72.46.92
4872trafficholder.com64.111.214.2
4926utoronto.ca142.150.210.7
4957syosetu.org133.242.85.51
4985sleazyneasy.com68.169.101.206
5045ohio.gov156.63.96.228
5055katestube.com64.188.53.206
5068filmstarts.de62.39.143.50
5110jahannews.com87.107.52.140
5134mangocity.com121.34.253.140
5141googleping.com208.109.97.183
5189e-rewards.com63.241.211.118
5231hostgator.in103.21.59.167
5232key-find.com50.97.32.136
5233dereferer.org195.234.228.80
5235fishmpegs.com68.169.73.82
5379germanbankersecrets.org50.7.157.122
5385markt.de213.95.6.42
5411beyond.com68.168.84.50
5429labirint.ru194.84.83.148
5546ponpare.jp160.17.13.128
5564epost.go.kr211.250.131.141
5583dir.bg194.145.63.12
5592gem.pl85.232.225.226
5605vikatan.com180.150.140.172
5613voici.fr89.31.150.122
5662umeng.com211.151.151.6
5667porsche.com84.21.48.97
5719townwork.net160.17.2.8
5785sublimetext.com209.20.75.76
5803advego.ru95.163.127.68
5806parkoz.com211.115.209.190
586233lc.com183.136.217.13
5873game321.com37.58.67.11
5877ekitan.com125.29.62.70
5888lufax.com222.73.151.131
5919orange.es62.36.20.46
5945element14.com83.100.177.204
5948totheglory.im38.83.103.226
5950alltop.com184.106.130.115
5965canadiantire.ca205.210.17.105
5995startlap.com77.111.91.52
6013yootheme.com188.226.251.160
6028rd.com54.235.221.229
603024ur.com91.202.65.190
6060findthebest.com54.215.14.104
6098seoul.co.kr211.169.247.231
6157draftkings.com23.203.3.237
6226usnetads.com74.208.192.200
6244sciencealert.com119.81.53.4
6275elnuevodia.com196.32.153.146
6310designspiration.net64.207.147.221
6399dreammail.jp106.187.122.190
6427epson.co.jp203.179.25.109
6538infor.pl193.164.157.245
6574minijuegos.com217.13.124.222
6578beyazperde.com62.39.143.50
6582artlebedev.ru195.218.200.11
6591bluestacks.com208.66.135.54
6595makeupalley.com69.60.134.134
6599themalaysianinsider.com203.223.159.194
6617soaindo.com119.81.21.170
6623cr173.com218.6.111.42
6630techgig.com115.112.206.15
6665rtl.be81.92.238.91
6690myfxbook.com108.163.193.212
6764shinhancard.com210.112.177.1
6786stamps.com216.52.211.93
6822nissan.co.jp150.63.3.21
6835wsodownloads.info185.66.140.67
6873todaysppc.com61.100.186.155
6879hanjin.co.kr203.251.153.29
6904freedigitalphotos.net95.138.157.18
6945wikimart.ru195.208.182.2
6953femina.hu195.228.155.84
6984mps.it195.7.19.86
6994pasionlibertadores.com184.105.139.44
6995hellomagazine.com62.22.15.85
7045leggo.it85.18.214.165
7069cpmfx.com81.4.124.18
7096n4hr.com184.173.179.185
710583suncity.com122.152.179.70
7108dip.jp61.197.187.238
7177rzeczpospolita.pl217.149.245.170
7180cue-monitor.jp210.227.82.43
7181yengo.com124.109.3.27
7194chanet.com.cn211.151.83.246
7206daniweb.com74.53.219.188
72212nn.jp218.219.149.44
7229ad-center.com208.99.88.30
7247mg.gov.br200.198.22.138
7248correos.es193.148.158.218
7251thegeekstuff.com173.192.49.107
7269plan-q-secret.com188.165.35.54
7288geeksforgeeks.org119.18.54.25
7319themarysue.com69.60.24.234
7344t3n.de94.198.61.181
7394savenkeep.com81.88.48.82
7421subtitles.at212.124.121.146
7430lordandtaylor.com69.10.139.22
7528brown.edu128.148.252.129
7568trojmiasto.pl193.104.50.210
7579qianxs.com211.144.120.28
7661telenet.be84.116.34.18
7665183.com.cn211.156.219.109
7698mumsnet.com87.246.123.17
7722ripoffreport.com192.225.215.36
7751netcombo.com.br201.6.19.16
7753copytraderpro.com50.7.157.122
7763planalto.gov.br189.9.37.9
7780gyakorikerdesek.hu91.198.131.12
7806jeep.com129.9.76.228
7871lyricsmode.com178.18.22.163
7902streetdirectory.com54.169.90.138
7907x3xtube.com64.111.213.29
7909networksolutionsemail.com205.178.146.50
7912fbdownloader.com54.245.81.123
7918mobypicture.com174.129.227.239
7924calcalist.co.il192.115.80.66
7946vw.com.tr217.68.221.221
7954madewell.com172.225.14.232
79675pao.com61.140.13.81
7971toodledo.com72.4.112.214
7975sensacine.com62.39.143.50
7992linksys.com66.161.11.90
8074standardmedia.co.ke212.100.244.246
8080eurobank.gr193.58.70.3
8095coocan.jp202.248.237.141
8114coach.com23.202.227.155
8138macmillandictionary.com195.138.194.22
8163deser.pl80.252.0.132
8174vno.co.kr121.162.155.183
8185gordonua.com91.224.10.20
8198russia.tv80.247.32.206
8264doortodoor.co.kr61.33.235.20
8272bluetradingonline.net50.7.157.122
8315diegrossechance.net50.7.157.122
8318translate.ru62.152.52.123
8321cnsnews.com199.175.56.184
8327jn.pt80.251.169.146
8398restorationhardware.com23.202.192.45
8401pcgameshardware.de62.146.104.132
8407escapadarural.com176.31.247.181
8421baharnews.ir87.107.133.77
8427transrush.com113.106.94.46
8428iporter.com222.239.73.34
8441davidsbridal.com208.74.49.181
8496ucr.edu138.23.226.208
8517gaymaletube.com64.188.56.183
8536ecpic.com.cn116.228.143.177
8538mbusa.com141.113.146.23
8551uploadbaz.com188.138.1.98
8590auto-profit-replicator.com198.154.200.85
8598pinkvilla.com174.129.200.25
8608priberam.pt62.28.135.67
8613newsen.com27.1.17.135
8635caclubindia.com67.227.132.46
8644parsine.com94.182.146.66
8662unionpaysecure.com173.223.54.31
8668streamay.com192.3.181.74
8671onenote.com23.13.167.6
8707vertex42.com216.177.136.65
8710ynetnews.com192.115.80.66
8719nielsen.com138.108.20.122
8727unext.jp125.63.43.78
8762locanto.com89.19.234.51
8852real.gr62.1.44.131
8869ca.com23.202.241.108
8967iesa.co50.31.86.60
8969kotree.com121.254.168.49
9005ytn.co.kr183.111.158.30
9026polskieradio.pl195.245.217.50
9049bolsademulher.com178.32.160.243
9084daringfireball.net199.192.241.217
9137wileyplus.com199.171.200.191
9139360game.vn49.213.127.67
9171photo.net64.95.64.39
9191wordtracker.com148.251.89.68
9293senate.gov23.202.229.166
9302twitpic.com173.236.110.98
9345femina.mk217.16.95.60
9353automaticmobilecash.com75.98.168.189
9385patriots.com216.235.243.188
9389hatelabo.jp59.106.194.34
9483ddo.jp219.94.135.204
9509closermag.fr83.231.216.103
9547bharatiyamobile.com72.167.40.178
9594brokenlinkcheck.com96.43.131.30
9678hungryapp.co.kr115.68.64.57
9698bradesconetempresa.b.br200.155.86.35
9763hitosara.com125.63.40.49
9771ui.ac.id152.118.24.181
97873987.com125.90.204.48
9821heydouga.com65.39.253.110
9849soccerline.co.kr112.175.88.170
9903webike.net125.206.119.33
9905flyme.cn113.108.229.220
9911temple.edu155.247.166.60
9915belluna.jp23.13.174.254
9931deichmann.com145.253.207.220
9962ntt.com210.226.39.112
9964shafaf.ir94.182.146.19
9966twitterfeed.com128.241.116.5
9967librus.pl46.248.183.21