Phishing Activity Trends Report

4th Quarter
2019
Unifying the
Glob a l Re sp onse
T o Cyb er cr ime

Table of Contents
Statistical Highlights for 2nd Quarter 20173

Phishing E-mail Reports and Phishing Site Trends

4

Brand-Domain Pairs Measurement

5

Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13

Activity October-December 2019

Published February 24, 2020

Phishing Activity Trends Report, 4th Quarter 2019
The Year in Phishing: 2019 Ended with
Ups and Downs

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing attacks and other identity theft techniques, asreported to the APWG by its member companies, its
Global Research Partners, through the organization’s
website at http://www.apwg.org, and by e-mailsubmissions to reportphishing@antiphishing.org. APWG
measures the evolution, proliferation, and propagation ofidentity theft methods by drawing from the research ofour member companies and industry experts.

Phishing Sites, 2019
100,000
80,00060,00040,00020,000

Phishing Defined

Table of Contents
Statistical Highlights for 2nd Quarter 20193

Most-Targeted Industry Sectors

5

Business E-Mail Compromise

6

Online Criminal Activity in Brazil

8

Use of Domain Names for Phishing

9

How Phishers Use Encryption to Fool Users

11

APWG Phishing Trends Report Contributors

122
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Dec-19

Nov-19Oct-19Sep-19Aug-19Jul-19Jun-19

May-19Apr-19Mar-19Feb-19Phishing is a crime employing both social engineering andtechnical subterfuge to steal consumers’ personal identity
data and financial account credentials. Social engineering
schemes prey on unwary victims by fooling them into
believing they are dealing with a trusted, legitimate
party, such as by using deceptive email addresses andemail messages. These are designed to lead consumers
to counterfeit Web sites that trick recipients into
divulging financial data such as usernames andpasswords. Technical subterfuge schemes plant malware
onto computers to steal credentials directly, often using
systems that intercept consumers’ account user names
and passwords or misdirect consumers to counterfeit
Web sites.

Jan-190

4th Quarter 2019 Phishing Activity Trends Summary•

The number of phishing attacks worldwide
receded in the fourth quarter of 2019, reverting
closer to the mean. [pp. 3-4]•

During 2019, the number phishing incidents in
Brazil increased by 232 percent. [pp. 9-10]•

Phishing that targeted webmail and Software-as-aService (SaaS) users continued to be biggest
category of phishing. [p. 5]•

Criminals perpetrating Business EmailCompromise (BEC) attacks used gift cards to cashout during the holiday shopping season. [pp. 6-7]•

Almost three-quarters of all phishing sites now use
SSL protection, highest recorded since early 2015,
and an indicator that users can’t rely on SSL alone
to understand whether a site is safe or not. [p.11]•

The use of gTLD domain names for phishingoccurs at a greater frequency than for ccTLDs. [p.9]Phishing Activity Trends Report, 4th Quarter 2019
Statistical Highlights for 4th Quarter 2019

OctoberNovember

DecemberNumber of unique phishing Web sites detected

76,804

39,58045,771

Number of unique phishing e-mail reports (campaigns)

45,05742,42445,072

333

325

341

received by APWG from consumers
Number of brands targeted by phishing campaigns

APWG’s contributing members report phishing URLs into APWG, and study the ever-evolving natureand techniques of cybercrime. The APWG tracks the number of unique phishing Web sites, a primarymeasure of phishing across the globe. This is determined by the unique base URLs of the phishing sites.
(A single phishing site may be advertised as thousands of customized URLs, all leading to basically thesame attack destination.)
The total number of phishing sites detected by APWG in the fourth quarter was 162,155. This was downfrom the 266,387 seen in Q3 and the 182,465 seen in Q2, and up from the 138,328 seen in Q4 2018.

Phishing Sites, 2019
100,000

90,00080,00070,00060,00050,00040,00030,00020,00010,0000
Jan-19 Feb-19 Mar-19 Apr-19 May-19 Jun-19 Jul-19 Aug-19 Sep-19 Oct-19 Nov-19 Dec-19

3
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019
Statistical Highlights for 4th Quarter 2019
“The year 2019 turned out to be a roller-coaster ride for phishing,” said Greg Aaron, APWG SeniorResearch Fellow and President of Illumintel Inc. “July though October was the worst period for phishingthat the APWG had seen in three years, and then phishing levels settled back down to more normal
levels.”The number of unique domain names used for phishing dropped at a lower rate, from 13,597 in October,to 15,261 in November, and to 12,260 in December.
The APWG also tracks the number of unique phishing reports (email campaigns) it receives fromconsumers and the general public. An e-mail campaign is a unique e-mail sent out to multiple users,
directing them to a specific phishing web site (multiple campaigns may point to the same web site).
APWG counts unique phishing report e-mails as those found in a given month that have the same email
subject line. The number of these unique phishing reports submitted to APWG during 4Q was 132,553, up
from 122,359 in Q3 and 112,163 in Q2. These were phishing emails submitted to APWG by the generalpublic, and excludes phishing URLs reported by APWG members directly into APWG’s eCrime
eXchange.

4
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019
Most-Targeted Industry Sectors – 4th Quarter 2019
In the fourth quarter of 2019, APWG member OpSec Security found that SaaS and webmail sites remained
the most frequent targets of phishing. Phishers continue to harvest credentials to those kinds of sites,
using them to perpetrate business e-mail compromises (BEC) and to penetrate corporate SaaS accounts.
Stefanie Wood Ellis, Anti-Fraud Product & Marketing Manager at OpSec Security, noted: “Phishingagainst Social Media targets grew every quarter of the year, doubling over the course of 2019.”
Attacks against cloud storage and file hosting sites remained less popular. Attacks against thecryptocurrency, logistics/shipping, gaming, insurance, energy, government, and healthcare sectors were
negligible during Q4, each at less than 1 percent of all phishing attacks detected.
OpSec Security (formerly known as MarkMonitor) is a founding APWG member and an online brandprotection organization, securing intellectual property and reputations through anti-fraud, brandprotection, domain management, and anti-piracy solutions.

MOST-TARGETED SECTORS, 4Q2019
Financial
Institution,
19.40%

Social Media,
6.80%
Ecommerce /Retail, 5.40%
Cloud Storage /File Hosting,
3.40%
Telecom, 3.30%

Payment,
19.80%

SaaS /
Webmail,
30.80%

5
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019
Business e-Mail Compromise, 4th Quarter 2019
APWG member Agari tracks the identity theft technique known as “business e-mail compromise” or BEC.
In a BEC attack, a scammer targets employees who have access to company finances, usually by sending
them email from fake or compromised email accounts (a “spear phishing” attack). The scammer
impersonates a company employee or other trusted party, and tries to trick the employee into sending
money. The attacker may prepare by spending weeks inside the organization’s network and accounts,
studying the organization’s vendors, billing system, and even the CEO’s style of communication. BEC
attacks have caused aggregate losses in the billions of dollars, at large and small companies.
Agari examined thousands of attempted BEC attacks observed during Q4 to assemble its data set. Agaricounts BEC as any response-based spear phishing attack that involves the impersonation of a trusted
party (a company executive, vendor, etc.) to trick a victim into making a financial transaction or sending
sensitive materials. Agari protects organizations against phishing, BEC scams, and other advanced email
threats.
Agari documented that scammers requested funds in the form of gift cards in 62 percent of BEC attacks,
up from 56 percent during the third quarter of 2019, and down from 65 percent in Q2. About 16 percent of
attacks requested payroll diversions, down from 25 percent in Q3. Some 22 percent of BEC attacks
involved requests for direct bank transfers.

BEC CASH-OUT METHOD, 4Q 2019
DirectTransfer
22%

Gift Card
62%

6
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Payroll
Diversion
16%

Phishing Activity Trends Report, 4th Quarter 2019
Business e-Mail Compromise, 4th Quarter 2019
The amount of money that an attacker can make by getting gift cards is significantly less than with a wiretransfer. During Q4, the average amount of gift cards requested by a BEC actor was more than $1,600. But
for wire transfer BEC attacks, the average amount requested in Q4 was over $55,000:
Average

MedianMin

Max

Wire transfer requests$55,395$28,350$2,550$680,456

Gift card requests$1,627$1,200$150$10,000

According to Crane Hassold, Agari’s Senior Director of Threat Research, “One of the really notable things
we saw during the Q4 was a change in the types of gift cards requested. Google Play was still the mostrequested gift card, but decreased from 27 percent to 15 percent of requests. We saw increases in requests
for gift cards for eBay, Target, Best Buy, and Sephora. The increase could be due to the fact that all ofthese companies sell physical goods, and the attacks took place during the holiday season. It may indicatethat scammers are looking to launder money by using the cards to buy physical goods that they can thensell, rather than putting the money into online cryptocurrency exchanges, which is also a popularlaundering option.”

7
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019

GIFT CARDS REQUESTED IN BEC ATTACKS,
3Q 2019
Best Buy, 7.8%
Walmart, 8.3%

Amazon, 7.3%
Steam, 6.5%

iTunes, 10.7%

Apple Store,
3.8%
Sephora, 3.3%
Home Depot,
1.8%

Target, 12.3%
Other, 9.7%

eBay, 13.9%

Google Play,
14.6%

Overall, BEC attackers used Gmail accounts 20 percent of the time. By type of mail account, attackers
used webmail accounts 57 percent of the time (Gmail being 35 percent of those), standard email accounts
on other domains 39 percent of the time, and clearly compromised (hacked) email accounts about 4
percent of the time.

8
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019
Online Criminal Activity in Brazil
APWG member company Axur is located in Brazil and concentrates on protecting companies and theirusers in Brazil from Internet-based threats. Axur especially monitors attacks against banks, technology
firms, airlines, and online marketplaces located in the country. Axur’s data shows how criminals areperpetrating identity theft in South America’s largest economy, and shows how these incidents are both alocal and international problems.
In the fourth quarter of 2019, Axur observed 8,872 phishing attacks. That was up significantly from the
6,862 cases Axur detected in Q3, the 5,297 cases in Q2, and the 3,220 in Q1. Specifically, these were attacks
against Brazilian brands or against foreign services that are available in Portuguese in Brazil.

Phishing Attacks by Target Category, Brazil, 2019
4000

SaaS/Webmail

Phishing attacks

3500
3000

Banks/Financial
Institutions

2500

E-commerce

2000

Other

1500
Frequent-flyer
programs/Airlines

1000

Expon.
(SaaS/Webmail)500
0
Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec

From February to December 2019, the monthly totals of phishing incidents in Brazil increased a
disturbing 232%:9
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019

PHISHING AGAINST E-COMMERCE SITES, BRAZIL, 2019
400
350
300
250
200
150

100
50
0

Week

The peak came in November, with 1,685 unique phishing cases in Brazil. This is the highest number of theyear and it came mainly from scams around the Black Friday shopping holiday. Historically, criminals in
Brazil have increased the frequency of their attacks near the end-of-year holidays, targeting the financial
sector to steal data. Similarly, 13th salary payments in Brazil (happening between November andDecember) are bank transitions that might attract attacks.

Use
Names for Phishing
wereofinDomain.C
APWG member RiskIQ provides ongoing analysis of where phishing is happening in the domain namesystem. RiskIQ analyzed 2,149 confirmed phishing URLs reported to APWG in Q4 2019. RiskIQ foundthat they were hosted on 1,328 unique second-level domains. RiskIQ provides digital risk protection byilluminating risk associated with an organization’s digital presence.
There are three types of top-level domains (TLDs) for purposes of this report:

10
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019•

“Legacy” generic TLDs, which existed before 2011. These include .COM, .ORG, and TLDs such as.ASIA and .BIZ. They represented 49% of the domain names in the world as of the beginning of
Q4, and represented 65% percent of the phishing domains in the sample set. There were 865 legacy
gTLDs in the sample set. Most of those were in .COM.

•

The new generic top-level domains (nTLDs), such as .WORK and .ICU, were released after 2011.
At the beginning of Q4, the nTLDs represented about 7% of the domains in the world, and wereabout 7% of the domains in the sample set. There were 88 nTLD domains in the sample set.

•

The country code domains (ccTLDs), such as .UK for the United Kingdom and .MX for Mexico.
ccTLDs were about 45% of the domains in the world as of the beginning of Q4, but were only 28%of the domains in the sample set. There were 375 ccTLD domains in the sample set.

The chart below shows the TLDs that had the most unique second-level domains used for phishing.
Rank

TLD

Category# of Unique Domains
in Sample Set (4Q 2019)

1
2
3
4
5
6
7
8
9
10
11
12
12
13
14
14
14
15

.COM
.ORG
.BR
.NET
.INFO
.UK
.RU
.IN
.XYZ
.ML
.AU
.TOP
.KR
.ZA
.CF
.TK
.VN
.MX

generic
generic
ccTLD
generic
generic
ccTLD
ccTLD
ccTLD
nTLD
ccTLD
ccTLD
nTLD
ccTLD
ccTLD
ccTLD
ccTLD
ccTLD
ccTLD

727
50
46
43
33
29
24
23
18
15
14
13
13
12
10
10
10
9

“Over 80 unique domains or IP addresses in the sample set used for phishing targeted multiple
companies and their brands,” said Jonathan Matkowsky, a cyber advisor at RiskIQ. “The bulk of themwere not on free hosting accounts, but either on maliciously registered domains used exclusively for
11
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019phishing, or on compromised sites—but relatively speaking, that is still a small percentage of the sample
set. This may just be a result of what is being detected and reported.”

How
were Phishers
in .COM,Use Encryption to Fool Victims
APWG contributor PhishLabs has been tracking how many phishing sites are protected by the HTTPS
encryption protocol. HTTPS is used to secure communications by encrypting the data exchanged between
a person’s browser and the web site he or she is visiting. HTTPS is especially important on sites that offer
online sales or password-protected accounts. Studying HTTP on phishing sites provides insight into how
phishers are fooling Internet users by turning an Internet security feature against them. PhishLabs
provides managed security services that help organizations protect against phishing attacks targeting
their employees and their customers.

% of Phishing Attacks Hosted on HTTPS% OF PHISHING ATTACKS

80%
70%
60%
50%
40%
30%
20%
10%

Q4 2019

Q3 2019

Q2 2019

Q1 2019

Q4 2018

Q3 2018

Q2 2018

Q1 2018

Q4 2017

Q3 2017

Q2 2017

Q1 2017

Q4 2016

Q3 2016

Q2 2016

Q1 2016

Q4 2015

Q3 2015

Q2 2015

Q1 2015

0%

QUARTERIn Q3 2019, 68 percent of sites used for phishing were using SSL. “But by the end of 2019, 74% of allphishing sites were using TLS/SSL,” observed John LaCour, Founder and CTO of PhishLabs. “Attackers
are using free certificates on phishing sites that they create, and are abusing the encryption alreadyinstalled on hacked web sites.”

12
Phishing Activity Trends Report
4th Quarter 2019www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 4th Quarter 2019
APWG Phishing Activity Trends Report Contributors

Agari protects organizations

Axur works to identify and fightagainst phishing, business email

the threats in the cyberspace thatcompromise (BEC) scams, andinterfere with the interests ofother advanced email threats.

companies, governments, andIllumintel provides intelligence,
analysis, due diligence, and public
policy advising in the areas ofcybersecurity and Internet-based
commerce.

individuals.

PhishLabs provides managed
OpSec Online™ (formerly

threat intelligence and mitigation

founding APWG member

services that protect brands,

MarkMonitor®), offers world classcustomers, and the enterprisebrand protection solutions.

from digital risks.

RiskIQ is a digital threat
management company enablingorganizations to discover,understand and mitigate known,
unknown, and malicious exposure
across all digital channels

About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focused on
eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware, and email spoofing. Membership is open to qualified financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multi-lateral treaty organizations, and NGOs. There are
more than 2,000 enterprises worldwide participating in the APWG.
APWG maintains it public website, <http://www.antiphishing.org>; the website of the STOP. THINK.
CONNECT. Messaging Convention <http://www.stopthinkconnect.org> and the APWG’s research website<http://www.ecrimeresearch.org>. These are resources about the problem of phishing and Internet frauds– andresources for countering these threats. The APWG, a 501(c)6 tax-exempted corporation, had its first meeting inNovember 2003 in San Francisco, and was incorporated in 2004 as an independent corporation controlled by its
board of directors, its executives and its steering committee.
The APWG Phishing Activity Trends Report is published by the APWG. For further information about the APWG, pleasecontact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For media inquiries related to thecompany-content of this report, please contact APWG Secretary General Peter Cassidy (pcassidy@apwg.org,+1.617.669.1123); Stefanie Ellis at OpSec Security (Stefanie.ellis@markmonitor.com); Jean Creech of Agari (jcreech@agari.com,+1.650.627.7667); Eduardo Schultze of Axur (eduardo.schultze@axur.com,+55 51 3012-2987); Stacy Shelley of PhishLabs(stacy@phishlabs.com, +1.843.329.7824); Kari Walker of RiskIQ (Kari@KariWalkerPR.com, +1.703.928.9996). Analysis and13

editing by Greg Aaron, Illumintel Inc., www.illumintel.com

Phishing Activity Trends Report
4th PWG
Quarter
thanks2019
its contributing members, above, for the data and analyses in this report0.
www.apwg.org • info@apwg.org