I am learning to use nmap. I am observing that most of the times when running a command like proxychains nmap -sT -PN -n -sV -p 80 XX.XX.XX.XX, I am getting the following output:

Starting Nmap 7.01 ( https://nmap.org ) at 2016-11-25 18:11 UTC
|S-chain|-<>-127.0.0.1:9050-<>-162.213.76.45:8080-<>-203.130.228.60:8080-<--timeout
Nmap scan report for XX.XX.XX.XX
Host is up (16s latency).
PORT   STATE  SERVICE VERSION
80/tcp closed http

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .


What I can understand is that the server failed to connect to the third proxy.

What I do not understand is: Does that mean that nmap packets are going from the second proxy to the target directly or the proxychaining is failing entirely and nmap packets are sent directly from my pc and revealing my identity?

Note: I'm running the tor browser, and therefore routing my proxychains through the tor network.

I think you are misunderstanding what a SSL certificate actually certifies, and what it is designed to protect against.

A standard certificate only certify that the owner of the certificate actually controls the domain in question. So a certificate for g00dbank.com only certifies that the owner controls the g00dbank.com domain. It does not certify that the owner is a bank, that she is good, or that the site is in fact the well known Good Bank Incorporated.

So SSL is not designed to protect against phishing. Just because you see the green lock up in the left corner does not mean that everything is well. You also need to verify that you are on the correct website - that you are on goodbank.com (as opposed to the phishy g00dbank.com) and that goodbank.com is in fact the website of Good Bank Incorporated.

To make this easier for the average user, there is something called Extended Validation (EV) certificates. These also verify that you are the legal entity that you claim to be, by requiring you to do some paperwork. Most major browsers highlight them by displaying the name of the owner in the address bar.

So to get an EV certificate the phishers at g00dbank.com would have to start a real business (thereby leaving a paper trail), and even then they would probably not get one because their name is to close to a sensitive target.

Lets Encrypt does not issue EV certificates. They issue ordinary ones. But the phishers you encountered could have gotten a certificate from anywhere. In fact, as IMSoP points out in comments, the method Lets Encrypt uses is employed by many of the established CA:s as well, the only difference being that Lets Encrypt is more efficient and cheaper. So this has nothing to do with Lets Encrypt specifically, and blocking them would solve nothing.
