Phishing Activity Trends Report

March, 2006

Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords, and tocorrupt local and remote navigational infrastructures to misdirect consumers to counterfeit websites and to authentic
websites through phisher-controlled proxies that can be used to monitor and intercept consumers’ keystrokes.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via the organization’s website at http://www.antiphishing.org or email submission toreportphishing@antiphishing.org. The APWG phishing attack repository is the Internet’s most comprehensive archiveof email fraud and phishing activity. The APWG additionally measures the evolution, proliferation and propagation ofcrimeware drawing from the independent research of our member companies. In the second half of this report are
tabulations of crimeware statistics and reportage on specific criminal software detected by our member researchers.

Highlights
•
•
•
•
•
•
•
•
•
•

Number of unique phishing reports received in March:
Number of unique phishing sites received in March:
Number of brands hijacked by phishing campaigns in March:
Number of brands comprising the top 80% of phishing campaigns in March:
Country hosting the most phishing websites in March:Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

18,4809666
70
3
United States
48.05 %
32 %3.9 %5.0 days
31 days

Methodology
APWG is continuing to refine and develop our tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiple
campaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).
The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For further
information, please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or APWG Secretary General Peter
Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Email Reports And Phishing Site Trends
The total number of unique phishing reports submitted to APWG in March 2006 was 18,480 – the most reports everrecorded. This is a count of unique phishing email reports. March 2006 continues the trend of more phishing attacks
and more phishing sites. The IRS phishing attack doubled in volume in March as compared to February (in the USA,the tax filing deadline was April 17 in 2006, as the usual April 15 deadline fell on a weekend this year.)

Phishing Reports Received March '05 - March '06
20000
14411 14987

16000
12883

15050

15820

17877

16882

17163

18480

15244

14135 13776 13562

12000
8000
4000
0
M archM ay

July

September

NovemberJanuary

M archThe number of unique phishing websites detected by APWG was 9666 in March 2006, a continual increase in unique
phishing sites during the first three months of 2006.

New Phishing Sites by Month March '05 - March '06
9715

10000

9103

9666

9000
8000

7197

7000
6000

4280 4564

5000
4000
3000

2870

5259 5242

4367 4630

2854 3326

2000
1000
0
March

May

July

September

NovemberAnti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

January

MarchTop Used Ports Hosting Phishing Data Collection Servers
March saw a continuation of a trend of
HTTP port 80 being the most popular port
used at 96.1% of all phishing sites reported.

Port 6180(.64%)
Port 87 (.53%)
7 other ports< .5% (2.7%)

Port 80(96.1%)

Brands and Legitimate Entities Hijacked By Email Phishing Attacks
Number of Reported
Brands

107

120
80

79 79

106
74 71

84

121
96 93

101 105
70

40

Ap
ril
M
ay
Ju
ne
Ju
A u ly
Se gu
pt st
em
b
O er
ct
o
No be
ve r
De mb
ce e rmb
Ja e rnu
Fe a ry
br
ua
r
M y
ar
ch

0
ar
ch

However, for the first time inmany months, a bank was thenumber one phished company,
by a large margin. This would
potentially indicate that thephishers have found a way toeasily monetize the phishedcredentials for this particularfinancial institution. This bank
may have a Track 2 issue,
allowing the phishers to create
counterfeit ATM cards.

160

M

March 2006 showed a major
drop off of brands hijacked
than February 2006

Hijacked Brands by Month
March '05 - March '06

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Most Targeted Industry Sectors
Financial Services continue to be themost targeted industry sector, growing to
90% of all attacks in the month of March.

Retail (2.9%)
ISP (5.7%)
Miscellaneous(1.4%)

Financial
Services (90%)

Web Phishing Attack Trends
Countries Hosting Phishing Sites
In March, Websense® Security Labs™ saw a continuation of the top three countries hosing phishing websites. The
United States remains the on the top of the list with 35.13%. The rest of the top 10 breakdown is as follows:
China 11.93%, Republic of Korea 8.85%, Germany 3.57%, Canada 3.52%, Japan 2.39%, Romania 2.29%, Spain
2.13%, Brazil 1.97%, Argentina 1.92%

Top 10 Phishing Sites Hosting Countries
Republic o f Ko rea
Germany
China

CanadaJapan
Ro mania
Spain
BrazilA rgentina

United States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

PROJECT: Crimeware
Crimeware Taxonomy & Samples According to Classification in MarchPROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Financial Institution Trojan Attack
During March, Websense Security Labs received reports of a Trojan Horse which targeted users of more than 100
financial institutions in the United States and Europe. Once installed on a user's machine, the malicious code
checked to see if there is an active window open (either "my computer" or Internet Explorer). If one of theseapplications is not open, the malicious code modified the contents of the hosts file on the local machine with a list ofsites all pointing to localhost (127.0.0.1).
If either of these applications were open, the behavior was different. In this case, the malicious code performed a
DNS lookup to a DNS server hosted in Russia and received an address for a website. The address returned from that
DNS server was then populated into the hosts file along with a list of target brands. If the target machine visited oneof the sites in the list, the machine was redirected to a fraudulent web site on the hosted machine in Russia. This
allowed the attacker to change the destination address through DNS if one of the servers was taken offline.
The web server used the hostname received to serve up pages for that particular target. There were more than 100
different phishing brands hosted on this site, all with unique pages for the particular attack.
Screenshot 1: Hosts file when no active window open.

Screenshot 2: Hosts file when active window open.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Discovered Microsoft Internet Explorer Zero Day Exploit
Additionally in March, APWG researchers received reports of a new Internet Explorer "zero-day" vulnerability thatallowed the launching of malicious code without consent from the end user. The vulnerability, which had no patch
available, exploited I.E. and could execute code without end user consent.
Websites were specifically crafted to exploit the text range vulnerability, which in turn runs shell code that downloads
an SDbot variant. The SDbot variant takes several actions, and then connects to an IRC server to await further
commands.
Tracking this vulnerability using honey clients, Websense Security Labs discovered more than 200 unique URL's thatwere using the vulnerability to run exploit code. The most common was the use of shellcode to run a Trojan Horse
downloader that downloads additional payload code over HTTP. The additional payload had been various forms of
BOT's, Spyware, Backdoors, and other Trojan Downloader's.
In late March, attackers began spamming e-mail lures in an attempt to attract users to infected websites that attack
the IE exploit. These e-mail messages contained excerpts from actual BBC news stories and offered a link to "ReadMore". Users who followed this link were taken to a website that was a spoofed copy of the BBC news story from thee-mail. This website exploited the unpatched createTextRange vulnerability and was being used to download andinstall a keylogger. This keylogger monitored activity on various financial websites and uploaded captured informationback to the attacker.
Infected website screenshot:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans - Keyloggers
Definition: Crimeware code which is designed with the intent of collecting information on the end user in order tosteal those users' credentials. Unlike most generic keyloggers, phishing-based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions and online
retailers and ecommerce merchants) in order to target specific information, the most common are: access to financial
based websites; ecommerce sites; and web-based mail sites.

Phishing-based Trojans – Keyloggers, Unique Variants

Password Stealing Malicious Code
Unique Applications
250
200
150
100

154

174

168

142

154

165

180

184

192

197

79

77

Au
gu
Se
st
pt
em
be
r
O
ct
ob
er
No
ve
m
De be
ce r
m
be
Ja r
nu
ar
y
Fe
br
ua
ry
M
ar
ch

Ju
ly

Ju
ne

ay
M

Ap
ril

50
0

Phishing-based Trojans reached an all time high in March with 197 unique applications detected and recorded by
APWG researchers.

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers
Password Stealing Malicious Code URLs
2500
2000
1500

1044
918 958 965 863

1000
500

2157

1912

260

1678
1100

495 526

gu
st
pt
em
be
r
O
ct
ob
N
er
ov
em
be
D
ec
r
em
be
Ja r
nu
a
Fe ry
br
ua
ry
M
ar
ch
Se

Au

Ju
ly

Ap
ril
M
ay
Ju
ne

0

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS specificinformation, crimeware browser-helper objects that redirect users to fraudulent sites, and crimeware that may install a
network level driver or filter to redirect users to fraudulent locations. All of these must be installed with the intention ofcompromising information which could lead to identify theft or other credentials being taken with criminal intent.
Along with phishing-based keyloggers, APWG researchers are witnessing increases in traffic redirectors. In particular
the highest volume is in malicious code which simply modifies DNS server settings or end-users’ hosts files toredirect either some specific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server
replies with “good” answers for most domains, however when these corrupted servers’ controllers want to direct end
users to a fraudulent website, they simply modify their name server responses. This is particularly effective because
the attackers can redirect any of the users requests at any time and the end users have very little indication that thisis happening as they could be typing in the address on their own (a ‘best practice’ of some time and standing) and not
following an email or Instant Messaging lure.
Phishing-based Trojans & Downloader’s Hosting Countries (by IP address)
The chart below represents a breakdown of the websites which were classified during March as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
The United States is still the top geographic location with 39.87%
The rest of the breakdown was as follows; Spain 10.7%, China 6.02%, Russia 2.94%, Brazil 2.67%, Republic ofKorea 2.2%, United Kingdom 2.09%, Argentina 1.26%, Portugal 1.1%, Germany 0.94%

Top 10 Phishing Based Keylogger and Trojan
Downloaders by Hosting Country
Spain

China
RussiaBrazilRepublic o f Ko rea
United Kingdo m
Argentina
Po rtugal
Germany

United States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research ContributorsdMarkMonitor

PandaLabs

Websense Security Labs™

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced Internet
threats to protect employee
computing environments.

For media inquiries please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or Peter Cassidy,
APWG Secretary General at 617.669.1123.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraudthat result from the growing problem of phishing and email spoofing. The organization provides a forum to discussphishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share information andbest practices for eliminating the problem. Where appropriate, the APWG will also look to share this information withlaw enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1500 companies and government agencies participating in the APWG andmore than 2300 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the website are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco and in June 2004
was incorporated as an independent corporation controlled by its steering committee, its board and its executives. The
APWG is a non-profit organization that operates under the IRS Rule 501c6 as a tax-exempted organization.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org