Phishing Activity Trends ReportAugust, 2005

Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via the organization’s website at http://www.antiphishing.org or email submission toreportphishing@antiphishing.org. The APWG phishing attack repository is the Internet’s most comprehensive archiveof email fraud and phishing activity. The APWG additionally measures the evolution, proliferation and propagation ofcrimeware drawing from the independent research of our member companies. In the second half of this report aretabulations of crimeware statistics and reportage on specific criminal software detected by our member researchers.

Highlights
••
••••
••••

Number of unique phishing reports received in August:
Number of unique phishing sites received in August:
Number of brands hijacked by phishing campaigns in August:
Number of brands comprising the top 80% of phishing campaigns in August:Country hosting the most phishing websites in August:Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

13776
5259
843United States
49 %
36 %
6%
5.5 days
31 days

Methodology
APWG is continuing to refine and develop its tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiplecampaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Email Reports And Phishing Site Trends
The total number of unique phishing reports submitted to APWG in August 2005 was 13,776. This is a slight
reduction from the 14,135 reported in July. Keep in mind, this is a count of unique phishing email reports.

Phishing
Phishing Reports
Reports Received
Received October-August
October-August
16000
16000

13468
1346812883
12845
12845
12883

14987
14987 15050
15050
14411
14411
14135
1413513776
13776

12000
12000
8975
8975 8829
8829
8000
6957
8000 6957

4000
400000

October
October

December
DecemberFebruary
February

April
April

June
June

AugustAugust

It is important to note that the number of unique phishing websites detected by APWG was 5,259 in August 2005, thehighest number. This may reflect an increasing tendency for phishers to target a diverse group of smaller brands,
and also an increased use of multiple sites to host a single attack, in order to increase their resiliency to takedown
efforts.

NewNew Phishing
Phishing Sites
Sites byby Month
Month October-August
October-August
6000
6000

5259
5259

5000
5000

4280
4280

4000
4000

2560
2560

3000
3000
2000
2000
1000
1000
00

1518
1518
1142
1142

2625
2625

2870
2870

2854
2854

March
March

AprilApril4564
4564

3326
3326

1707
1707

October
October November
November December
December January
January February
February

MayMayJune
June

JulyJuly

AugustAugust

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For further
information, please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or APWG Secretary General Peter
Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Top Used Ports Hosting Phishing Data Collection Servers
Port 4443(2.63%)

August saw a continuation of a trend of using
look-alike cousin domain names to host phishingsites. Consequently, the use of alternate ports
has decreased and the standard HTTP port 80
rose to 94.07% of all phishing sites reported.

Port 680(1.43%)
7 other ports< 2% (1.9%)

Port 80(94.07%)

Brands and Legitimate Entities Hijacked By Email Phishing Attacks
Number of Reported Brands

107

120
80

64

79

697974

7184

40AugustJulyJuneMayApri l0h

As with July, we saw an insurance company
being spoofed.

160

Marc

There is an increasing number of ISP phishingattacks, attempting to trick consumers intodivulging credit card information and otherpersonal information based on the guise that
their Internet Service is going to be terminated.

Hijacked Brands by Month
January-August

Janu
aryFe
brua
ry

In August, the number of reportedly phishedbrands rose to 84. APWG is seeing a widediversity of brands being spoofed, very small
financial institutions all over North America andWestern Europe are steadily appearing.

Most Targeted Industry Sectors
Financial Services continue to be the mosttargeted industry sector staying steady at nearly
85% of all attacks.
APWG received several reports during the monthof August by legitimate companies who had
somehow been identified as hosting phishingsites. In one case, the consumers could notreach the company's website because access
was being blocked by an anti-phishing toolbar.
In another case, a domain name registrar hadseized the domain name and disabled it in theDNS. This highlights the need for caution andstrict verification that a site is indeed fraudulent
before being added to anti-phishing blacklists orhaving a domain name registrar take action.

Retail (2.4%)

ISP (8.3%)
Miscellaneous(4.8%)

FinancialServices(84.5%)

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends
Countries Hosting Phishing Sites
In August, Websense® Security Labs™ saw a continuation of the top three countries hosing phishing websites, withChina and the Republic of Korea switching order. The United States remains the on the top of the list with 27.9%,
with the top 10 breakdown as follows; China: 12.15%, Republic of Korea: 9.6%, France: 4.07%, Japan: 3.65%,
Germany: 3.23%, Australia: 3.05%, Russia: 2.4%, Canada: 2.21%, Sweden: 2.04%

Top 10 Phishing Sites Hosting Countries
FranceRepublic o f Ko reaJapan
Germany
A ustralia
ChinaRussia
CanadaSweden

United States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

PROJECT: Crimeware
Crimeware Taxonomy & Classification Details
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Phishing-based Trojans - Keyloggers
During the month of August, Websense Security Labs have witnessed a slight decrease in the number of variants ofkeyloggers, but a steady increase of password stealing malicious code URLs.

Phishing-based Trojans – Keyloggers, Unique Variants

Password
Password Stealing
Stealing Malicious
Malicious CodeCodeUnique
Unique Applications
Applications
200200

154
154

150
150
100
100

77
77

79
79

AprilAprilMayMay

174
174

168
168

JulyJuly

AugustAugust505000June
June

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers

Password
Password Stealing
Stealing Malicious
Malicious Code
Code URLs
URLs
1200
1200
918
918

958
958

July
July

AugustAugust

1000
1000
800
800
600
600
400
400

495
495

526
526

MayMay

June
June

260
260

20020000
April
April

Phishing-based Trojans & Downloader’s Hosting Countries (by IP address)
The chart below represents a breakdown of the websites which were classified during August as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
The United States is still the top geographic location with 40%, Brazil continues to maintain second with 15%,
growing from 11% last month. The largest jump this month came from Spain more than doubling from 5.4% lastmonth to almost 12.5% in August.
The rest of the breakdown was as follows; China 7.82%, Korea 3.9%, United Kingdom 3.6%, Russia 3.5%, Germany
1.5%, Romania 1.38%, Italy 1.38%

Phishing
Phishing Based
Based Keylogger
Keylogger andand Trojan
TrojanDownloaders
byHosting
Country
Downloaders by Hosting Country
SpainSpain
China
China
KoKorearea

BBrazil
razil

UK
UK
RussiaRussiaGermany
GermanyRo
Romania
mania
Italy
Italy

UnitedUnitedStates
StatesAnti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

dMarkMonitor

PandaLabs

Websense® Security Labs™

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced Internetthreats to protect employee
computing environments.

For media inquiries please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or Peter Cassidy,
APWG Secretary General at 617.669.1123.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft andfraud that result from the growing problem of phishing and email spoofing. The organization provides a forum todiscuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share
information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share thisinformation with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1300 companies and government agencies participating in the APWG andmore than 1900 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of memberorganizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the website are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco and in June 2004
was incorporated as an independent corporation controlled by its steering committee, its board and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org