Phishing Activity Trends Report

2 Quarter
2019nd

Uni f yin g th e
Glo bal Res po ns e
To C yb er cr im e

Table of Contents
Statistical Highlights for 2nd Quarter 20173

Phishing E-mail Reports and Phishing Site Trends

4

Brand-Domain Pairs Measurement

5

Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13

Activity April-June 2019

Published September 12, 2019

Phishing Activity Trends Report, 2nd Quarter 2019

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing attacks reported to the APWG by its member
companies, its Global Research Partners, through theorganization’s website at http://www.apwg.org, and bye-mail submissions to reportphishing@antiphishing.org.
APWG also measures the evolution, proliferation, andpropagation of other methods of identity theft bydrawing from the research of our member companies.

Phishing Attacks Up, Especially
Against SaaS and Webmail Services

Phishing Defined
Phishing is a criminal mechanism employing both social
engineering and technical subterfuge to steal consumers’
personal identity data and financial account credentials.
Social engineering schemes use spoofed e-mails
purporting to be from legitimate businesses andagencies, designed to lead consumers to counterfeit Web
sites that trick recipients into divulging financial datasuch as usernames and passwords. Technical subterfuge
schemes plant crimeware onto computers to steal
credentials directly, often using systems to intercept
consumers’ account user names and passwords -- and tocorrupt local navigational infrastructures to misdirect
consumers to counterfeit Web sites (or authentic Web
sites through phisher-controlled proxies used to monitor
and intercept consumers’ keystrokes).

2nd Quarter 2019 Summary•

The number of phishing attacks rose in thesecond quarter of 2019, eclipsing the number
seen in the first quarter of 2019, and far above theamount recorded in the second half of 2018. [pp.
3-4]•

Employees should beware of requests for giftcards and payroll account changes. Gift cards
were requested in 65% of business email
compromise (BEC) attacks. About 20% of BEC
attacks requested payroll diversions, and 15%
requested direct bank transfers. The averagebogus bank transfer request was for $64,717.
[pp.6-9]•

Phishing that targeted Software-as-a-Service(SaaS) and webmail services continued to bebiggest category of phishing. [p. 5]•

Certain top-level domains had more prevalentlevels of phishing in them, while others avoided
phishing. [p. 9]•

Criminals in South America used holiday
shopping to take advantage of consumers. [p. 12]

Table of Contents
Statistical Highlights for 2nd Quarter 20193

Most-Targeted Industry Sectors

5

Business E-Mail Compromise

6

Use of Domain Names for Phishing

9

How Phishers Use Encryption to Fool Users

11

Online Criminal Activity in Brazil

12

APWG Phishing Trends Report Contributors

15

2
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
Statistical Highlights for 2nd Quarter 2019
April

May

June

Number of unique phishing Web sites detected

59,756

61,82060,889Number of unique phishing e-mail reports (campaigns)

37,05440,17734,932

341

308

289

received by APWG from consumers
Number of brands targeted by phishing campaigns

APWG’s contributing members report phishing URLs into APWG, and study the ever-evolving natureand techniques of cybercrime. The APWG tracks the number of unique phishing Web sites, a primarymeasure of phishing across the globe. This is determined by the unique base URLs of the phishing sites.
(A single phishing site may be advertised as thousands of customized URLs, all leading to basically thesame attack destination.)
The total number of phishing sites detected by APWG in 2Q was 182,465, up slightly from the 180,768
seen in 1Q2019, and up notably from the 138,328 seen in 4Q 2018 and the 151,014 seen in 3Q 2018.

Phishing Sites, 1Q2019-2Q2019
90,00080,00070,00060,00050,00040,00030,00020,00010,0000
Jan-19Feb-19Mar-19Apr-19

May-19Jun-193
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
The APWG also tracks the number of unique phishing reports (email campaigns) it receives fromconsumers and the general public. An e-mail campaign is a unique e-mail sent out to multiple users,
directing them to a specific phishing web site (multiple campaigns may point to the same web site).
APWG counts unique phishing report e-mails as those found in a given month that have the same email
subject line.
The number of unique phishing reports submitted to APWG during 1Q 2019 was 112,163, virtually thesame as the 112,393 seen in 1Q. These were phishing emails submitted to APWG by the general public,
and excludes phishing URLs reported by APWG members directly into APWG’s eCrime eXchange.

Unique Phishing Reports Received from the
Public/Consumers, 2Q2019
45000
40000
35000
30000
25000
20000
15000
10000
5000
0
Jan-19Feb-19Mar-19Apr-19

May-19Jun-194
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
Most-Targeted Industry Sectors – 2nd Quarter 2019
In 2Q 2019, APWG member MarkMonitor observed that SaaS and webmail sites remained the biggest
targets of phishing. Phishers continue to harvest credentials to those kinds of sites, using them toperpetrate business e-mail compromises (BEC) and to penetrate corporate SaaS accounts. Stefanie Wood
Ellis, Anti-Fraud Product & Marketing Manager at MarkMonitor, noted: “There is an increased diversityof targets in the financial industry than in either SAAS/Webmail or Payment Services, where attacks areheavily focused on less than a dozen organizations. There was an increased diversity of targets in thefinancial industry, however.”Attacks against cloud storage and file hosting sites remained less popular, down from 11.3 percent of all
attacks in Q1 2018 to just 3 percent in 2Q 2019. Attacks against the cryptocurrency, gaming, government,
and healthcare sectors were negligible during 2Q. This is a shift from past years, when attacks against
certain gaming platforms and Bitcoin-related sites were frequent occurrences.
Founding APWG member MarkMonitor is an online brand protection organization, securing intellectual
property and reputations through anti-fraud, brand protection, domain management, and anti-piracy
solutions.

5
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
Business e-Mail Compromise, 2nd Quarter 2019
APWG member Agari tracks the identity theft technique known as “business e-mail compromise” or BEC.
In a BEC attack, a scammer targets employees who have access to company finances, usually by sending
them email from fake or compromised email accounts (a “spear phishing” attack). The scammer
impersonates a company employee or other trusted party, and tries to trick the employee into sending
money, such as a wire transfer to a bank account controlled by the criminal. Sometimes the attacks may also
involve malware. The attacker may prepare by spending weeks inside the organization’s network andaccounts, studying the organization’s vendors, billing system, and even the CEO’s style of communication.
These scams target both large and small companies and organizations, and BEC attacks have caused
aggregate losses in the billions of dollars. Agari examined thousands of attempted BEC attacks observed
during Q2 to assemble its data set. Agari counts BEC as any response-based spear phishing attack thatinvolves the impersonation of a trusted individual (company executive, vendor, etc.) to trick a victim into
making a financial transaction or sending sensitive materials. Agari protects organizations against
phishing, business email compromise (BEC) scams, and other advanced email threats.
Agari documented gift cards were requested in 65 percent of BEC attacks during the second quarter of
2019. Some 20 percent of attacks requested payroll diversions; 15 percent requested direct bank transfers.
According to Crane Hassold, Agari’s Senior Director of Threat Research, “The most frequent cash out
method sought by BEC attackers is, by a long shot, gift cards. During the second quarter of 2019, nearly
two-thirds of all BEC attacks observed by the Agari Cyber Intelligence Division (ACID) requested that thetarget purchase gift cards and send them to the attacker. Because they are more anonymous, lessreversible, and do not require the use of a mule intermediary, gift cards have quickly emerged as the mostpopular cash out option for scammers over the past year.”
Although gift cards afford obvious benefits to BEC scammers, one of the biggest downsides is that theamount of money that an attacker can make in each gift card BEC attack is significantly less than with awire transfer. During the second quarter, the average amount of gift cards requested by a BEC actor wasjust over $1,500. For wire transfer BEC attacks, the average amount requested was nearly $65,000:.
Average

MedianMin

Max

Wire transfer requests$64,717$31,350$5,000$950,000

Gift card requests$1,562$1,000$200$6,0006
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
Hassold added: “While there is a massive discrepancy in the amount of money that can be made per
attack between these two cash-out methods, the continuous increase in the frequency of gift card BEC
scams indicates that the return for these attacks outweighs the downsides.”By far, the most common gift card requested by BEC scammers was for Google Play, Google’s online appstore (41%). That was followed by gaming site Steam Wallet (12%), Amazon (9%), and Apple iTunes
with (8%).

Gift Cards Requested in BEC Attacks,
Q2 2019
Other, 19.7%
Hotels.com,
2.8%

Google Play,
40.7%

Apple Store,
3.0%
Home Depot,
3.4%
Target, 5.3%

eBay, 5.3%
Walmart, 5.6%
Apple iTunes,
7.5%

Amazon, 9.0%

Steam Wallet,
12.2%

BEC criminals were careful to send their emails when the victims were starting their work days and could
take action. Half of all BEC attacks were sent between 8:00am and 12:00pm (in the victim’s time zone).
Almost 90 percent of attacks were sent between 5:00am and 3:00pm (in the victim’s time zone). And 97
percent were sent between Monday and Friday, avoiding weekends when victims were off of work.

7
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019

Time of Day BEC Emails Were Sent
(target's time zone, Q2 2019)
Percent of BEC Emails

16%
14%
12%
10%
8%
6%
4%
2%
0%

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Hour of Day

Where do phishers get the tools needed to perpetrate these smaller-scale but highly targeted attacks?
Sometimes, from other phishing scams. Criminals get email account usernames and passwords fromtraditional, mass phishing attacks. Indeed, BEC may be behind the surge in attacks against webmail and
SaaS accounts. (See “Most-targeted Industry Sectors,” above.) Some criminals perpetrate traditional
phishing to fuel their own BEC spear phishing. Others visit online underground criminal forums andpurchase credentials gathered from traditional phishing attacks, which they then use to pull off tailored
spear phishing attacks and compromises.

8
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
Use of Domain Names for Phishing
APWG member RiskIQ provides ongoing analysis of where phishing is happening in the domain namesystem. RiskIQ provides digital risk protection by illuminating risk associated with an organization’s
digital presence in open, deep and dark web, mobile, and social digital channels to proactively protectorganizations, brands, people, and data.
RiskIQ analyzed 7,633 confirmed phishing URLs reported to APWG in Q2 2019. RiskIQ found that they
were hosted on 5,203 unique second-level domains (and 78 were hosted on unique IP addresses, without
domains).
There are three types of top-level domains (TLDs) for purposes of this report:•“Legacy” generic TLDs, which existed before 2011. These include .COM, .ORG, and TLDs such as.ASIA and .BIZ. They represented 49% of the domain names in the world as of the beginning of
Q2, and represented 64% percent of the phishing domains in the sample set. There were 3,316
legacy gTLDs in the sample set. Most of those were in .COM, which had 2,812 domains in the set.

•

The new generic top-level domains (nTLDs), such as .ONLINE and .XYZ, were released after 2011.
At the beginning of Q2, the nTLDs represented 6.5 percent of the domains in the world, and were
7 percent of the domains in the sample set. There were 356 nTLD domains in the sample set.

•

The country code domains (ccTLDs), such as .UK for the United Kingdom and .MX for Mexico.
ccTLDs were about 45% of the domains in the world as of the beginning of Q2, but were only 29
percent of the domains in the sample set. There were 1,531 ccTLD domains in the sample set.
ccTLD Internationalized domain names were included as part of this category; there was one ofthose.

The chart below shows the TLDs that had the most unique second-level domains used for phishing:
Rank

TLD / Category# of Unique Domains in
Sample Set (2Q 2019)

1.COM / Legacy

2,812

2

.NET / Legacy

2083.BR / ccTLD (Brazil)

146

4.ORG / Legacy

145

5.UK / ccTLD (United Kingdom)

137

6.TOP / nTLD

120

7

.INFO / Legacy

1198.IN / ccTLD (India)

105

9.AU / ccTLD (Australia)

80

9Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 201910

.XYZ / nTLD

63

11

.ICU / nTLD

59

12

.CL / ccTLD (Chile)47

13.GA / ccTLD (Gabon)

47

14

43

16

.ML / ccTLD (Mali).CF / ccTLD (Central African
Republic).CO / ccTLD (Colombia)

17.RU / ccTLD (Russian Federation)

38

18.PL / ccTLD (Poland)37

19.ID / ccTLD (Indonesia)

36

20.IT / ccTLD (Italy)

36

15

41
41

Several of the ccTLDs above -- .GA, .CF, and .ML—are “repurposed” ccTLDs where management rights
have been granted to a third party that offers domain registration is free, so it is no surprise that these
ccTLDs fall in the top 20.
.XYZ represented about 9 percent of all the nTLD domain names registered in the world as of the end oflast quarter. But .XYZ had about 17% of the reported nTLDs domains used for phishing in the sample set.
Although .ONLINE represented only 5 percent of the registered nTLD domains in the world, more thantriple that percentage (~18%) of the nTLD domains in the sample were on .ONLINE second-leveldomains. In contrast: .SITE represented 4.5 percent of the registered nTLD domains in the world and.CLUB represented 4.7 percent, but neither .SITE nor .CLUB contained even close to 1 percent of thereported nTLD domains used for phishing.
.TOP was 12.9 percent of all the nTLDs in the world as of the end of last quarter, but had only 2.3 percentof the reported phishing nTLDs in the sample set. However, more than half of the phishing domains in.TOP appeared to be randomly generated combinations of four lower-case letters and digits. It is
generally understood that criminals using such algorithms in furtherance of their harmful cyber
operations rely, in part, on both speed and low or free registration costs to have adequate malicious
domain resources available. “It may reasonably be inferred that registrar platforms with APIs to manage
and register domain names and SSL certs in bulk, and at the lowest possible cost across extensions in realtime, may be more susceptible to this kind of attempted abuse, said RiskIQ cyber advisor Jonathan
Matkowsky. “Such API-driven platforms can also be used legitimately, such as by domain resellers. Partof mitigation may include raising awareness, so that those registrars whose infrastructures are being used
to acquire resources in bulk for harmful cyber operations can more fully evaluate whether their anti-abusesafeguards are reasonably appropriate for this increased risk.”
10
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
How Phishers Use Encryption to Fool Victims
APWG contributor PhishLabs has been tracking how many phishing sites are protected by the HTTPS
encryption protocol. HTTPS is used to secure communications by encrypting the data exchanged between
a person’s browser and the web site he or she is visiting. HTTPS is especially important on sites that offer
online sales or password-protected accounts. Studying HTTP on phishing sites provides insight into how
phishers are fooling Internet users by turning an Internet security feature against them. PhishLabs
provides managed security services that help organizations protect against phishing attacks targeting
their employees and their customers.
“More than half – 55 percent – of phishing attacks detected in the second quarter of 2019 were using SSL.
It is clear that users can’t use SSL to know if a site is safe or not,” said John LaCour, CTO of PhishLabs.
The Extended Validation SSL Certificate (EV SSL) is the most rigorous form of SSL certificate on themarket, and proves the legal identity of the cert/site owner. Currently the Google Chrome, Mozilla
Firefox, and Apple Safari web browsers show the verified legal identity of an EV cert owner in thebrowser user interface, either before or instead of the domain name. But in August 2019 Google andMozilla announced that they plan to remove this distinction in the near future, which may effectively kill
the use of EV certs. APWG will keep an eye on this development.

% of Phishing Attacks Hosted on HTTPS
70%% OF PHISHING ATTACKS

60%
50%
40%
30%
20%
10%
0%
Q1
Q2
Q3
Q4
Q1
Q2
Q3
Q4
Q1
Q2
Q3
Q4
Q1
Q2
2016 2016 2016 2016 2017 2017 2017 2017 2018 2018 2018 2018 2019 201911
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
Online Criminal Activity in Brazil
APWG member company Axur is located in Brazil and concentrates on protecting companies and theirusers in Brazil from Internet-based threats. Axur especially monitors attacks against banks, technology
firms, airlines, and online marketplaces located in the country. Axur’s data shows how criminals areperpetrating identity theft in South America’s largest economy, and shows how these incidents are both alocal and international problems.
In the second quarter of 2019, Axur observed 5,297 cases of phishing – up 64 percent from the 3,220 that
Axur observed in Q1. Specifically, these were attacks against Brazilian brands or against foreign services
that are available in Portuguese in Brazil.

Phishing and Malware Detections,
Brazil, 1Q2019-2Q2019
2500
2000
1500
1000
500
0
Jan-19Feb-19Mar-19Apr-19Phishing

MalwareMay-19Jun-19In the first quarter, the SaaS (Software as a Service) and Webmail sector was the main target of phishingattacks in Brazil, as it was also globally. However, in the second quarter in Brazil, phishing cases thatwere targeted to e-commerce, banks and financial institutions were the most frequent. Frauds affecting
those sectors accounted for the jump in the number of phishing attacks:

12
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org
!

/3
0/
1/ 201
6/ 8
1/ 201 - 1
13 9 /5/
1/ /201 - 1/ 201
20 9 12 9/2/2 1/ 019 1/1 019
927/2 - 1 /20
2/ 019 /26 19/
3
2/ /20 - 2 201
10 1 /2 99/
2/ /201 - 2 201
17 9 /9 9/2/2 2/ 019 2/1 019
624/2 - 2 /20
3/ 019 /23 19/
3/ 3/20 - 3 201
10 1 /2 99/
3/ /201 - 3 201
17 9 /9 9/
3/ /201 - 3/ 201
24 9 16 9/2/2 3/ 019 3/2 019
331/2
4/ /201 3/3 019
7/ 9 0/
4/ 201 - 4 201
14 9 /6 9/
4/ /201 - 4/ 201
21 9 13 9/2/2 4/ 019 4/2 019
028/
2
5/ /201 4/2 019
5/ 9 7/
5/ 201 - 5 201
12 9 /4 9/
5/ /201 - 5/ 201
19 9 11 9/2/2 5/ 019 5/1 019
8/26/2 5 20
6/ 019 /25 19/22/
6/ 201 - 6/ 019
9/ 9 1/
6/ 201 - 6 201
16 9 /8 9/
6/ /201 - 6/ 201
23 9 15 9/2 - 6 /2
01 /2 0199
- 6 2/2/3 019
0/
20
19

12

Number of phishing attacks

Phishing Activity Trends Report, 2nd Quarter 2019

Phishing Attacks by Sector and Volume,
Brazil, 1Q2019-2Q2019

2500

2000

1500

1000

500

0
Jan-19Other
Feb-19E-commerce
Mar-19Apr-19
May-19Banks/Financial Institutions
Jun-19

SaaS/Webmail

Phishing attacks that targeted online retail trended upward sharply between May and June:

Phishing Attacks Against E-commerce Targets,
Brazil, 1Q2010-2Q2019

350

300

250

200

150

100

50

0

13

Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
That peak coincided with holidays such as Mother’s Day (May 12) and Dia dos Namorados, a holiday
similar to Valentine’s Day celebrated on June 12. Many of the Dia dos Namorados attacks used maliciously
registered domain names that named the holiday:

14
Phishing Activity Trends Report
2nd Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 2nd Quarter 2019
APWG Phishing Activity Trends Report Contributors

Agari protects organizations

Axur works to identify and fightagainst phishing, business email

the threats in the cyberspace thatcompromise (BEC) scams, andinterfere with the interests ofother advanced email threats.

companies, governments, andindividuals

MarkMonitor, a global leader inenterprise brand protection, offers
comprehensive solutions andservices that safeguard brands,
reputation and revenue fromonline risks.

PhishLabs provides managed
threat intelligence and mitigation
services that protect brands,
customers, and the enterprisefrom digital risks.

iThreat provides risk data,
intelligence tools, and analysis tohelp clients protect theirintellectual & Internet properties.

RiskIQ is a digital threat
management company enablingorganizations to discover,understand and mitigate known,
unknown, and malicious exposure
across all digital channels

About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focused on
eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware, and email spoofing. Membership is open to qualified financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multi-lateral treaty organizations, and NGOs. There are
more than 2,000 enterprises worldwide participating in the APWG.
APWG maintains it public website, <http://www.antiphishing.org>; the website of the STOP. THINK.
CONNECT. Messaging Convention <http://www.stopthinkconnect.org> and the APWG’s research website<http://www.ecrimeresearch.org>. These are resources about the problem of phishing and Internet frauds– andresources for countering these threats. The APWG, a 501(c)6 tax-exempted corporation, had its first meeting inNovember 2003 in San Francisco, and was incorporated in 2004 as an independent corporation controlled by its
board of directors, its executives and its steering committee.
The APWG Phishing Activity Trends Report is published by the APWG. For further information about the APWG, pleasecontact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For media inquiries related to thecompany-content of this report, please contact APWG Secretary General Peter Cassidy (pcassidy@apwg.org,+1.617.669.1123); Stefanie Ellis at Markmonitor (Stefanie.ellis@markmonitor.com); Jean Creech of Agari (jcreech@agari.com,+1.650.627.7667); Eduardo Schultze of Axur (eduardo.schultze@axur.com,+55 51 3012-2987); Stacy Shelley of PhishLabs(stacy@phishlabs.com, +1.843.329.7824); Kari Walker of RiskIQ (Kari@KariWalkerPR.com, +1.703.928.9996).

15

Analysis and editing by Greg Aaron, iThreat Cyber Group, www.ithreat.com

Phishing Activity Trends Report
2ndPWG
Quarter
thanks 2019its contributing members, above, for the data and analyses in this report0.
www.apwg.org • info@apwg.org!