A device comprising: a site certificate mapping store; a fraudulent certificate detection module configured to: obtain a current certificate from a target site, compare the current certificate to a last certificate for the target site in the site certificate mapping store, determine, in response to the current certificate matching the last certificate in the site certificate mapping store, that the current certificate is genuine, and store the current certificate as a last certificate for subsequent access to the target site, and obtain, in response to the current certificate not matching the last certificate in the site certificate mapping store, one or more confirmation certificates for the target site from a remote certificate screening service, determine that the current certificate is fraudulent if the current certificate does not match at least one of the one or more confirmation certificates, and analyze, in response to all of the one or more confirmation certificates matching the current certificate, one or more characteristics of the current certificate and the target site to determine whether the current certificate is fraudulent a site certificate mapping store; a fraudulent certificate detection module configured to: obtain a current certificate from a target site, compare the current certificate to a last certificate for the target site in the site certificate mapping store, determine, in response to the current certificate matching the last certificate in the site certificate mapping store, that the current certificate is genuine, and store the current certificate as a last certificate for subsequent access to the target site, and obtain, in response to the current certificate not matching the last certificate in the site certificate mapping store, one or more confirmation certificates for the target site from a remote certificate screening service, determine that the current certificate is fraudulent if the current certificate does not match at least one of the one or more confirmation certificates, and analyze, in response to all of the one or more confirmation certificates matching the current certificate, one or more characteristics of the current certificate and the target site to determine whether the current certificate is fraudulent obtain a current certificate from a target site, compare the current certificate to a last certificate for the target site in the site certificate mapping store, determine, in response to the current certificate matching the last certificate in the site certificate mapping store, that the current certificate is genuine, and store the current certificate as a last certificate for subsequent access to the target site, and obtain, in response to the current certificate not matching the last certificate in the site certificate mapping store, one or more confirmation certificates for the target site from a remote certificate screening service, determine that the current certificate is fraudulent if the current certificate does not match at least one of the one or more confirmation certificates, and analyze, in response to all of the one or more confirmation certificates matching the current certificate, one or more characteristics of the current certificate and the target site to determine whether the current certificate is fraudulent