Phishing Activity Trends Report
Combined Report for September and October, 2006
Summarization of Combined September-October Report Findings►In summer and early fall, the number of phishing spoof sites soared, driving the number of unique phishing URLs to
37,444 in October, a 757 percent increase over the 4367 reported by the APWG in October 2005 - and up some 236
percent from the 11,121 detected just six months before in April, 2006. APWG contributing analysts from MarkMonitor
attributed most all of this increase to phishing campaigns employing very large numbers of sites with URLs using
multiple subdomains attached to spoof domains (e.g. 123.phishsite.com, 234.phishsite.com, 345.phishsite.com.)
Most of the multiple-subdomain sites were used in attacks against one frequently phished financial institution. The
APWG believes the multiple subdomains ploy is used to defeat spam filters and URL-filtering systems (such as thosein browser toolbars) by rapidly deploying variants that have not yet been added to blocking lists or ‘black lists’ ofphishing URLs. ► Phishers in the month of October also broke the previous record for the number of brands attacked
in a single month with 176 being subjected to spoofing, up 14 percent from the previous high of 154 in July 2006.
► For the second month running, the number of crimeware variants rose to break records - in October hitting 237, up
38 percent from August, 2006. ► Note: In this report, APWG restates its August, 2006 total for unique phishing sites
as 19,660 (from the previously reported 10091), reflecting an augmented methodology for distinguishing andenumerating URLs used in phishing campaigns, including the subdomain variants discussed in this summary.

Phishing Defined and Report Scope
Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords, and tocorrupt local and remote navigational infrastructures to misdirect consumers to counterfeit websites and to authentic
websites through phisher-controlled proxies that can be used to monitor and intercept consumers’ keystrokes.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via its member companies, Global Research Partners, the organization’s website at
http://www.antiphishing.org and email submission to reportphishing@antiphishing.org. The APWG phishing attack
repository is the Internet’s most comprehensive archive of email fraud and phishing activity. The APWG additionallymeasures the evolution, proliferation and propagation of crimeware drawing from the independent research of ourmember companies. In the second half of this report are tabulations of crimeware statistics and reportage on specificcriminal software detected by our member researchers.

Statistical Highlights for October 2006
•
•
•
•
•
•
•
•
•
•

Number of unique phishing reports received in October:
Number of unique phishing sites received in October:
Number of brands hijacked by phishing campaigns in October:
Number of brands comprising the top 80% of phishing campaigns in October:Country hosting the most phishing websites in October:Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

26877
37444
176
18
United States
56 %
32 %
4.9 %
4.5 days
30 daysMethodology
APWG is continuing to refine and develop our tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiple
campaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).

Phishing Email Reports And Phishing Site Trends for October 2006
The total number of unique phishing reports submitted to APWG in October 2006 was 26,877 – an increase of overfour thousand attacks from September and the second highest recorded by the APWG. This is a count of unique
phishing email reports received by the APWG from the public, its members and its research partners.

Phishing Reports Received Oct '05 - Oct '06
28571
23670

24000
20000
16000

26,877

26150

28000

15820

16882

15244

17877 17163 18480 17490

22136

20109

12000
8000
4000
0
October

DecemberFebruary

April

June

AugustOctober

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For further
information, please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or APWG Secretary General Peter
Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

The number of unique phishing websites detected by APWG was 37,444 in October 2006, up 52% from a monthearlier. We can see that there are far more phishing emails being sent. In particular there are more sub-domains
being used, in an attempt to fool anti-phishing filters.

New Phishing Sites by Month Oct '05 - Oct '06
37444

40000
32000

24565
24000

19660

16000
8000

4367

4630 7197

9715 9103 9666

11121 11976 10047

14191

0
October

DecemberFebruary

April

June

AugustOctober

Top Used Ports Hosting Phishing Data Collection Servers in October 2006
October saw a continuation of atrend of HTTP port 80 being themost popular port used at 95.09%
of all phishing sites reported.

Port 4443
Port 8443(2.64%)(.43%)
Port 81(.37%)

Port 80(95.09%)Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

7 other ports <.3%
(1.47%)

Brands & Legitimate Entities Hijacked By Email Phishing Attacks in October 2006
Number ofReported Brands
October 2006 showed the highest
amount of brands being phishedever recorded by the APWG with
176. Larger numbers of smallerbanks and credit unions are being
spoofed and subject to phishingattacks.

Hijacked Brands by Month
Oct '05 - Oct '06
200
160
120

121
96 93

137 130
101 105

80

70

176

154 148
117

92

40

O
ct
o
No be
ve r
De mb
ce e rmb
Ja e rnu
Fe a ry
br
ua
r
M y
ar
ch
Ap
ril
M
ay
Ju
ne
Ju
A u ly
Se gu
pt st
em
b
O er
ct
ob
er

0

Most Targeted Industry Sectors in October 2006
Financial Services continue to be the mosttargeted industry sector at 92.6% of all
attacks in the month of October.
Additionally, ISPs continue to surpass Retailas a targeted industry.

Retail (2.3%)
ISP (2.8%)
Miscellaneous(2.3%)

Financial
Services(92.6%)

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends in October 2006
Countries Hosting Phishing Sites
In October, Websense® Security Labs™ saw a continuation of the top three countries hosing phishing websites. The
United States remains the on the top of the list with 28.78%. The rest of the top 10 breakdown is as follows –China
11.96%, Republic of Korea 8.4%, Germany 3.7%, Australia 3.64%, Canada 3.6%, Japan 3.01%, United Kingdom
2.75%, Italy 2.22%, India 2.11%.

Top 10 Phishing Sites Hosting Countries
Republic o f Ko rea

Germany
A ustralia
Canada
Japan

China

United Kingdom
Italy
India

United States

PROJECT: Crimeware
Crimeware Taxonomy & Samples According to Classification in October 2006
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Phishing-based Trojans - Keyloggers
Definition: Crimeware code which is designed with the intent of collecting information on the end-user in order tosteal those users' credentials. Unlike most generic keyloggers, phishing-based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions and online
retailers and ecommerce merchants) in order to target specific information, the most common are; access to financial
based websites, ecommerce sites, and web-based mail sites.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Keyloggers, Unique Variants Break Record Again in October

Password Stealing Malicious Code
Unique Applications
250
200
150

197
180
180 184 192
154 165

215 212182 172

216

237

Au
Se gus
t
pt
em
be
r
O
ct
ob
er

Ju
ly

Ap
ril
M
ay
Ju
ne

O
ct
o
No ber
ve
m
De be
ce r
m
be
Ja r
nu
ar
Fe
y
br
ua
ry
M
ar
ch

100
50
0

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers in October
Password Stealing Malicious Code URLs
3500
3000
2500

2157

1912

2000
1500
1000

2945

2683

863

1044

2303

2100

1850

1678

2122
1800

1100

500

Ap
ri l
M
ay
Ju
ne

Ju
ly
Au
Se gus
t
pt
em
be
r
O
ct
ob
er

O

ct
ob
N
ov er
em
be
D
ec
r
em
be
Ja r
nu
a
Fe ry
br
ua
ry
M
ar
ch

0

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS specificinformation, crimeware browser-helper objects that redirect users to fraudulent sites, and crimeware that may install a
network level driver or filter to redirect users to fraudulent locations. All of these must be installed with the intention ofcompromising information which could lead to identify theft or other credentials being taken with criminal intent.
Along with phishing-based keyloggers we are seeing high increases in traffic redirectors. In particular the highest
volume is in malicious code which simply modifies your DNS server settings or your hosts file to redirect either somespecific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server replies with “good”
answers for most domains, however when they want to direct you to a fraudulent one, they simply modify their nameserver responses. This is particularly effective because the attackers can redirect any of the users requests at any
time and the end-users have very little indication that this is happening as they could be typing in the address on theirown and not following an email or Instant Messaging lure.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans & Downloader’s Hosting Countries (by IP address) in October
The chart below represents a breakdown of the websites which were classified during October as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
The United States is the top geographic location with 30.91%
The rest of the breakdown was as follows; Russia 28.5%, Germany 6.45%, Brazil 4.57%, China 4.22%, Republic ofKorea 3.22%, Switzerland 1.61%, Italy 1.61%, France 1.61%, Argentina 1.34%.

Top 10 Phishing Based Keylogger and Trojan
Downloaders by Hosting Country
Germany
B razil
RussiaChina
Republic o f Ko rea
Switzerland
Italy
FranceA rgentina

United States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Statistical Highlights for September 2006
•
•
•
•
•
•
•
•
•
•

Number of unique phishing reports received in September:
22136
Number of unique phishing sites received in September:
24565
Number of brands hijacked by phishing campaigns in September:
117
Number of brands comprising the top 80% of phishing campaigns in September: 19
Country hosting the most phishing websites in September:
United States
Contain some form of target name in URL:
49 %No hostname just IP address:
34 %Percentage of sites not using port 80:
2.99 %
Average time online for site:
4.5 days
Longest time online for site:
30 daysPhishing Email Reports And Phishing Site Trends for September 2006
The total number of unique phishing reports submitted to APWG in September 2006 was 22,136 – an decrease ofover four thousand attacks from August. This is a count of unique phishing email reports received by the APWG fromthe public, its members and its research partners.

Phishing Reports Received Sept. '05 - Sept. '06
28571
26150

28000
23670

24000
20000
16000 13562

15820

16882

15244

17877 17163 18480 17490

20109

22136

12000
8000
4000
0
September

NovemberJanuary

M archM ayAnti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

July

September

The number of unique phishing websites detected by APWG was 24,565 in September 2006. This is a 25 percent
increase over the 19660 unique phishing sites detected in August. The main reason for this increase is that there has
been a rise in the number of sub-domains used for phishing, often a number of subdomains attached to a counterfeit
domain being used in different phishing attack or multiple attacks against a single brandholder.

New Phishing Sites by Month Sept. '05 - Sept. '06
28000

24565

24000

19660

20000
16000
12000
8000

5242 4367 4630

7197

9715 9103 9666

11121 11976

14191
10047

4000
0
September

NovemberJanuary

March

May

July

September

Top Used Ports Hosting Phishing Data Collection Servers in September 2006
September saw a continuation of atrend of HTTP port 80 being the mostpopular port used at 98.02% of allphishing sites reported.

Port 443(.46%)

Port 80(98.02%)Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Port 680(.33%)

7 other ports <.3%
(1.19%)

Brands & Legitimate Entities Hijacked in Email Phishing Attacks in September 2006
Number ofReported Brands
September 2006 showed a dropof over 30 brands hijacked
compared to August.

Hijacked Brands by Month
Sept. '05 - Sept '06
160
120 106 96 93

121

137 130
101 105

154 148
117

92
70

80
40

Se
pt
em
b
O er
ct
o
No be
ve r
De mb
ce e rmb
Ja e rnu
Fe a ry
br
ua
r
M y
ar
ch
Ap
ril
M
ay
Ju
ne
Ju
A u ly
Se gu
pt st
em
be
r

0

Most Targeted Industry Sectors in September 2006
Financial Services continue to be the mosttargeted industry sector at 91.5% of all
attacks in the month of September.
Additionally, ISPs have surpassed Retail asa targeted industry.

Retail (2.6%)
ISP (3.4%)
Miscellaneous(2.6%)

Financial
Services(91.5%)

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends in September 2006
Countries Hosting Phishing Sites
In September, Websense® Security Labs™ saw a continuation of the top three countries hosing phishing websites.
The United States remains the on the top of the list with 31.22%. The rest of the top 10 breakdown is as follows –China 12%, Republic of Korea 8.9%, Germany 3.17%, Canada 2.97%, Japan 2.44%, France 2.31%,
Poland 2.24%, Romania 1.98%, Brazil 1.98%.

Top 10 Phishing Sites Hosting Countries
Republic o f Ko rea
Germany
CanadaChina

Japan
FranceP o landRo mania
B razil

United States

PROJECT: Crimeware
Crimeware Taxonomy & Samples According to Classification in September 2006
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Phishing-based Trojans - Keyloggers
Definition: Crimeware code which is designed with the intent of collecting information on the end-user in order tosteal those users' credentials. Unlike most generic keyloggers, phishing-based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions and online
retailers and ecommerce merchants) in order to target specific information, the most common are; access to financial
based websites, ecommerce sites, and web-based mail sites.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Keyloggers, Unique Variants Rise to New Record in September

Password Stealing Malicious Code
Unique Applications
250
200
150
100

184 192 197 180
165 180154142

215 212182 172

216

Au
Se gus
t
pt
em
be
r

Ju
ly

Ap
ril
M
ay
Ju
ne

Se
pt
em

be
r
O
ct
ob
er
No
ve
m
De be
ce r
m
be
Ja r
nu
ar
Fe
y
br
ua
ry
M
ar
ch

50
0

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers
Password Stealing Malicious Code URLs
3500
3000
2500

1000

2157

1912

2000
1500

2945

2683

965 863 1044

2100

1678

2303
1850

2122

1100

500

Ap
ril
M
ay
Ju
ne
Ju
ly
Au
Se gu
s
pt
em t
be
r

Se
pt
em
b
O er
ct
ob
N
ov er
em
D
ec ber
em
be
Ja r
nu
Fe ary
br
ua
ry
M
ar
ch

0

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS specificinformation, crimeware browser-helper objects that redirect users to fraudulent sites, and crimeware that may install a
network level driver or filter to redirect users to fraudulent locations. All of these must be installed with the intention ofcompromising information which could lead to identify theft or other credentials being taken with criminal intent.
Along with phishing-based keyloggers we are seeing high increases in traffic redirectors. In particular the highest
volume is in malicious code which simply modifies your DNS server settings or your hosts file to redirect either somespecific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server replies with “good”
answers for most domains, however when they want to direct you to a fraudulent one, they simply modify their nameserver responses. This is particularly effective because the attackers can redirect any of the users requests at any
time and the end-users have very little indication that this is happening as they could be typing in the address on theirown and not following an email or Instant Messaging lure.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans & Downloader’s Hosting Countries (by IP address) in September 2006
The chart below represents a breakdown of the websites which were classified during September as hosting
malicious code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a
keylogger.
The United States has moved back to being the top geographic location since being surpassed by Russia in Augustwith 33.29%.
The rest of the breakdown was as follows; Russia 25%, Brazil 5.8%, China 4.28%, Republic of Korea 3.59%, Spain
3.45%, France 2.62%, Germany 2.2%, Portugal 2.07%, Argentina 2.07%.

Top 10 Phishing Based Keylogger and Trojan
Downloaders by Hosting Country
B razil
China
Republic o f Ko rea

RussiaSpain
FranceGermany
Po rtugal
A rgentina

United States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research ContributorsdMarkMonitor

PandaLabs

Websense Security Labs™

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced Internet
threats to protect employee
computing environments.

For media inquiries please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or Peter Cassidy,
APWG Secretary General at 617.669.1123.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraudthat result from the growing problem of phishing and email spoofing. The organization provides a forum to discussphishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share information andbest practices for eliminating the problem. Where appropriate, the APWG will also look to share this information withlaw enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1500 companies and government agencies participating in the APWG andmore than 2600 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the website are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG, a 501c6 tax-exempted corporation, was founded by Tumbleweed Communications and a number ofmember banks, financial services institutions, and e-commerce providers. It held its first meeting in November 2003 in
San Francisco and in June 2004 was incorporated as an independent corporation controlled by its steering committee,
its board and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org