Phishing Activity Trends Report

January, 2005

Phishing is a form of online identity theft that uses spoofed emails designed to lure recipients to fraudulent web sites
which attempt to trick them into divulging personal financial data such as credit card numbers, account usernames
and passwords, social security numbers, etc. By hijacking the trusted brands of well-known banks, online retailers
and credit card companies, data suggests that phishers are able to convince up to 5% of recipients to respond tothem. As a result of these scams, an increasing number of consumers are suffering credit card fraud, identity theft,and financial loss.
The Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group (APWG)
via the organization’s web site at http://www.antiphishing.org or email submission to reportphishing@antiphishing.org.
The APWG phishing attack repository is the Internet’s most comprehensive archive of email fraud and phishingactivity.

Highlights••••
•
••
•
•
•

Number of active phishing sites reported in January:
Average monthly growth rate in phishing sites July through January:
Number of brands hijacked by phishing campaigns in January:
Number of brands comprising the top 80% of phishing campaigns in January:
Country hosting the most phishing web sites in January:
Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

2560
28%
647United States
25 %
53 %
9.53 %
5.8
31 days

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry
association focused on eliminating the identity theft and fraud that result from the growing problem of phishing andemail spoofing. For further information, please contact press@antiphishing.org, Secretary General Peter Cassidy at
617.669.1123 or Ronnie Manning at rmanning@websense.com or 858.320.9274.
Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org
APWG - AntiPhishing Working
Group

Digitally signed by APWG - Anti-Phishing
Working GroupDN: CN = APWG - Anti-Phishing Working Group,
C = US, L = Cambridge, S = MA, O = AntiPhishing Working Group
Reason: I am the author of this document
Location: Cambridge, MA
Date: 2005.02.24 21:20:38 -05'00'

Top Used Ports Hosting Phishing Data Collection Servers
The rise in non port 80 hosted sites and the numberof sites which are hosting phishing attacks continues
to lead us to believe that the number of machinesthat are compromised and are being used to hostthese attacks is growing.

Port 87,
2.30%

Port 9090,
0.87%

Port 81,0.58%

Port 85,
3.20%

Port 80,
90.20%

Email Phishing Attack Trends
In January, there were 12,845 new, unique phishing email
messages reported to the APWG. This is a substantial
increase of 42% over the unique reports for December,and represents an average monthly growth rate of 30%
since July (2,625).
The number of phishing web sites supporting theseattacks rose even more dramatically. In January, there
were 2,560 unique sites reported, a jump of 47% overDecember (1740) and more than double the number
reported just three months ago in October (1186).

What Brands Are Being Hijacked By Email Phishing Attacks?
Number of Reported Brands
In January, the number of reported hijacked brands roseto 64, including nine brands first reported this month, eightof them financial institutions. This brings to 140 the total
number of brands that have reportedly been hijacked
since the APWG began examining phishing trends andreporting their findings in November of 2003.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

21 (Otherports all<.5%),
2.85%

Brand Concentration
The figures below illustrate the concentration of phishing activity as reported against hijacked brands. The number ofreported brands comprising the top 80% of all phishing activity has remained roughly stable in recent months, withseven brands accounting for the bulk of phishing activity in December. Of the top seven in January, the top threewere the same brands as the top three in December, and three of December’s top seven are no longer in the top
80%.

Most-Targeted Industry Sectors
The most targeted industry sector for phishing attacks continues to be Financial Services, from the perspective of
total number of unique baiting sites as well as number of companies targeted. This sector averaged 80% of allhijacked brands in January with eight of the nine new brands reported this month falling in this category.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends
Countries Hosting Phishing Sites
United States continues to be the top geographic location for hosting Phishing sites with more than 32 %. Other top
countries are: China 13%, Korea 10%, Japan 3.1%, and Germany 2.7%, Brazil 2.7%, Romania 2.2%, Canada 2.1%,
France 2.7%, and Australia 2.1%.

Phishing Sites Hosting Countries

Canada FranceRomania
BrazilAustraliaGermanyJapanUSA

Korea/ China / Taiwan
HK

Utilizing More Attack Vectors
Cross-Site Scripting / Redirects
During the month of January, Websense® Security Labs™ saw a number of attacks using cross-site scripting toredirect URL’s from popular web sites in order to better present themselves and as a means to prevent blocking. An
example of this is an attack that was discovered utilized the Lycos search engine.
By crafting a URL, the hacker can redirect any end user though Lycos directory to their fraudulent page. An example
is below:
http://r.lycos.com/r/BJTWQSAUE/http://www.websensesecuritylabs.com
This link will automatically send the end user to Lycos, which in turn redirects the to thewww.websensesecuritylabs.com web site.
We suspect that this type of attacks may be one of the reasons why the number of sites that have no hostname isdown from 63% in December ’04 to 53% in January ‘05.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Malicious Code Phishing
During the month of January we also witnessed some significant gains in attackers utilizing malicious code in order togain access to end user keystrokes. Password stealing Trojans are not just coming through email; we have seen
multiple attacks through Microsoft Messenger where Trojan Horses and password stealing keyloggers are run. TheBropia worm had five variants in January alone.
Malicious web sites are also rising as a vector to install password stealing keyloggers. These sites are utilizing
several browser vulnerabilities, some of which are un-patched, to install and run upon simply accessing a web site.
Also common are blended attacks which use combinations of email, instant messaging, and web sites to gain accessto systems.
Some examples of password stealing Trojan Horses from January include:•••••

Buchon.cBropia Worm
Goldun (Several Variants)
Bankos Trojan (Several Variants)
Banks-De (Several Variants)

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

Tumbleweed Message Protection Lab

Websense® Security Labs™

The mission of the Tumbleweed Message Protection
Lab is to analyze current and emerging enterpriseemail threats, and design new email protection
technologies.

Websense Security Labs mission is to discover,investigate, and report on advanced internet threats toprotect employee computing environments.

Lead investigator:
John Thielens, johnt@tumbleweed.com

Lead investigator:
Dan Hubbard, dhubbard@websense.com

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft andfraud that result from the growing problem of phishing and email spoofing. The organization provides a forum todiscuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share
information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share
this information with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are currently over 706 organizations participating in the APWG and more than 1100members. Note that because phishing attacks and email fraud are sensitive subjects for many organizations that
do business online, the APWG has a policy of maintaining the confidentiality of member organizations.
The Web site of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the Web site are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco and in June
2004 was incorporated as an independent corporation controlled by its steering committee, its board and its
executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org