A method for blocking network connections, the method comprising: intercepting, by a hardware processor, a certificate from a server when establishing a secure connection between the server and a client; obtaining, by the hardware processor, attributes from the intercepted certificate; determining, by the hardware processor, whether the intercepted certificate is similar to one or more forbidden certificates stored in a database of forbidden certificates by (i) retrieving from the database of forbidden certificates a cluster of vectors of attributes of the forbidden certificates, (ii) constructing an N-dimensional vector based on the obtained attributes of the intercepted certificate, and (iii) comparing the constructed N-dimensional vector of attributes of the intercepted certificate to the cluster of vectors of attributes of forbidden certificates produced as a result of clustering, wherein, when constructing the N-dimensional vector based on the obtained attributes, different weights are used for each attribute to calculate coordinates of respective attributes and wherein the coordinates of a given attribute are based on frequencies of occurrences of the given attribute and wherein the intercepted certificate is found to be similar to a forbidden certificate of the one or more forbidden certificates when: a distance between the constructed N-dimensional vector of the certificate and a center of at least one cluster in the database is less than a radius of the at least one cluster; or a measure of proximity between the constructed N-dimensional vector and the center of the at least one cluster is less than a threshold value; and blocking, by the hardware processor, the connection when the intercepted certificate is similar, based on the determination, to the one or more forbidden certificates. intercepting, by a hardware processor, a certificate from a server when establishing a secure connection between the server and a client; obtaining, by the hardware processor, attributes from the intercepted certificate; determining, by the hardware processor, whether the intercepted certificate is similar to one or more forbidden certificates stored in a database of forbidden certificates by (i) retrieving from the database of forbidden certificates a cluster of vectors of attributes of the forbidden certificates, (ii) constructing an N-dimensional vector based on the obtained attributes of the intercepted certificate, and (iii) comparing the constructed N-dimensional vector of attributes of the intercepted certificate to the cluster of vectors of attributes of forbidden certificates produced as a result of clustering, wherein, when constructing the N-dimensional vector based on the obtained attributes, different weights are used for each attribute to calculate coordinates of respective attributes and wherein the coordinates of a given attribute are based on frequencies of occurrences of the given attribute and wherein the intercepted certificate is found to be similar to a forbidden certificate of the one or more forbidden certificates when: a distance between the constructed N-dimensional vector of the certificate and a center of at least one cluster in the database is less than a radius of the at least one cluster; or a measure of proximity between the constructed N-dimensional vector and the center of the at least one cluster is less than a threshold value; and a distance between the constructed N-dimensional vector of the certificate and a center of at least one cluster in the database is less than a radius of the at least one cluster; or a measure of proximity between the constructed N-dimensional vector and the center of the at least one cluster is less than a threshold value; and blocking, by the hardware processor, the connection when the intercepted certificate is similar, based on the determination, to the one or more forbidden certificates.