I see a few services advertising the ability to protect against phishing and ransomware attacks. ISPs sell services which supposedly protect you and some routers like Check Point 700/900 series. Is this real? How does this work? If I download malware/ransomeware or am sent a phishing email - that's likely TLS encrypted. Can the ISP/router decrypt and scan such traffic? Or is what they're advertising only for non encrypted traffic or just doesn't work?

  • It often requires you allow the router to MITM you by installing a root certificate it generates into your trust store. And it can only use heuristics. They aren't perfect. – forest Nov 19 '18 at 7:46

In general, phishing attacks comes on emails, and the majority of ISPs gives you email services for you in their platforms not on the home routers (in general). So the email services are hosted and process by your ISP, that is normally how ISPs protects you from that types of attacks.

For phishing attacks normally they have antispam/antiabuse systems that allows them to filter domains, ips, suspect emails and so on

Not the answer you're looking for? Browse other questions tagged or ask your own question.