Phishing Activity Trends Report

June, 2005

Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using keylogger systems to intercept consumers online account user names and passwords.
The Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group (APWG)
via the organization’s website at http://www.antiphishing.org or email submission to reportphishing@antiphishing.org.
The APWG phishing attack repository is the Internet’s most comprehensive archive of email fraud and phishingactivity. Starting with this month’s report, the APWG additionally measures the evolution, proliferation andpropagation of crimeware drawing from the independent research of our member companies.

Highlights
•••
••
••
••

Number of phishing reports received in June:
Number of brands hijacked by phishing campaigns in June:
Number of brands comprising the top 80% of phishing campaigns in June:
Country hosting the most phishing websites in June:
Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

15,05074
5United States
46 %41 %8%
5.9 days
30 daysPhishing Reports Received October-June
16000
12845

13468

14411

14987 15050

12883

12000
8975
8000

8829

6957

40000
October

DecemberFebruary

AprilJune

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For further
information, please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or APWG Secretary General Peter
Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Top Used Ports Hosting Phishing Data Collection Servers
June saw a continuation of a trend of using look-alikecousin domain names to host phishing sites.
Consequently, the use of alternate ports has
decreased and the standard HTTP port 80 is in use at
94.1% of all phishing sites reported.

port 4443(.61%)

port 8081(0.123%)
port 81(0.56%)
port 85(0.51%)

14 other ports(2%)

port 80(94.1%)

Brands and Legitimate Entities Hijacked By Email Phishing Attacks
Number of Reported Brands
In June, the number of reportedly phishedbrands dropped when compared with April,reflecting numbers similar to previousmonths.

Hijacked Brands by Month
January-June
160

107

120
80

79

79

January February MarchApril

64

69

74

400

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

MayJuneMost Targeted Industry Sectors
Financial Services continue to be the mosttargeted industry sector growing to nearly
91% of all attacks.

Retail (2.7%)
ISP (5.4%)
Miscellaneous(1.35%)

FinancialServices(90.54%)

Web Phishing Attack Trends
Countries Hosting Phishing Sites
In June, Websense Security Labs saw a large decrease in the number of phishing sites that are hosted in China. TheUnited States remains the on the top of the list with 35.5%, with the top 10 breakdown as follows; China 11.2%,
Korea 10.1%, France 5.6%, Germany 3.2%, Canada 2.8%, Japan 2.4%, Italy 1.76%, Romania 1.72%, Netherlands
1.65%.

Phishing
Phishing Sites
Sites Hosting
Hosting Countries
Countries
KoKorea
reaFranceFranceGermany
Germany

China
China//HKHK//Taiwan
TaiwanCanadaCanadaJapanJapan
Italy
Italy
Ro
Romania
mania
Netherlands
Netherlands

UnitedUnitedStates
StatesAnti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Attack Method Update
PROJECT: Crimeware
Since early 2004, the APWG has been observing technical advances worldwide in the way that criminals areattacking unsuspecting users in order to steal consumer information. Although phishing with social engineering lureemails and counterfeit websites is the most prominent phishing technique, there is a rise in alternative methods to coopt consumers’ online credentials or gain control of their accounts without using direct deception. (The APWG notesthat in Brazil, the archetypical phishing approach is actually a blended social engineering and technical subterfuge
attack, driving a general population to generic entertainment sites in order to plant key loggers, techniques manifestly
more potent than pure social engineering schemes when you examine the alleged phishers’ takings reported during
police arrests there over the past year – upwards of tens of millions each time.)
Automated systems based on trojaning schemes and session hikacking systems have reported worldwide over thepast 18 months in a trend of development that has surged markedly over the past 3 months, supporting the APWG’sview that automated phishing systems are the way of the future worldwide for this criminal enterprise.
Furthermore, PandaLabs detected a Trojan-type phishing system which exploited to the full one of the main
advantages that this type of crimeware possesses compared to traditional phishing: Trj/Bancos.NL includes a list of
thousands of brandholders’ domains, demonstrating the advance of phishing technology toward wide-scope
consumer-credential capture techniques. The PandaLabs finding indicates a drive by phishers to effect a generickeylogger potent against all credible potential targets.
It is the APWG’s belief that phishers will, over time, adopt more automated attack systems based on technicalsubterfuge to supplement social engineering schemes - or replace them. To remain relevant in its data reporting, theAPWG initiated PROJECT: Crimeware, a program of collaborative research designed to capture, record andcharacterize incidents that are new and emerging in order for the APWG to include them in the monthly report and,possibly, other reports that specifically address the threats posed by crimeware.
What is crimeware? The APWG defines it as a genus of technology distinguished from adware, spyware andmalware by the fact that it is, by design, developed for the single purpose of animating a financial or business crime.

Crimeware Taxonomy & Classification Details
PROJECT: Crimeware proposes types of crimeware attacks which will be classified and reported upon monthly:

Phishing-based Trojans - Keyloggers
Definition: Crimeware code which is designed with the intent of collecting information on the end-user in order tosteal those users' credentials. Unlike most generic keyloggers, phishing-based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions and online
retailers and ecommerce merchants) in order to target specific information, the most common are; access to financial
based websites, ecommerce sites, and web-based mail sites.

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS specificinformation, crimeware browser-helper-objects that redirect information to fraudulent sites, and crimeware that may
install a network level driver or filter to redirect to fraudulent locations. All of these must be installed with the intentionof compromising information which could lead to identify theft or other credentials being taken with criminal intent.

Man-in-the-middle Phishing (Pharming)
Definition: An attack that intercepts information in between two parties’ communications in order to redirect users toa fraudulent location. The most popular attack is DNS cache poisoning.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

OtherThis is reserved for anything that does not fit into the other attack classes. If a new attack class becomes frequentenough we can create its own class. Some recent examples that belong in there are:••Typo-attacks: mistyping a popular domain and being infected with crimeware.
Search-engine poisoning: being directed to a fraudulent website which downloads crimeware onto yourmachine simply by searching on a search engine.

Phishing-based Trojans – Keyloggers, Unique Variants

Password
Password Stealing
Stealing Malicious
Malicious CodeCodeUnique
Unique Applications
Applications
200200

154
154

150
150
1001007777

7979

April
April

MayMay505000June
June

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers

Password
Password Stealing
Stealing Malicious
Malicious Code
Code URLs
URLs
600
600

495
495

500
500

526
526

400
400
300
300

260
260

200
200
100
10000
April
April

MayMayAnti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

JuneJunePhishing-based Trojans & Downloader’s Hosting Countries (by IP address)
The below chart represents a breakdown of the websites which were classified during June as hosting malicious codein the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
Of interest is that the United States is still the top geographic location with more than 55%, Brazil is third with almost
7%. To date, Brazil still has the highest concentration of phishing-based keyloggers that target Brazilian financial
institutions and use deception techniques written in Portuguese. Also, unlike regular phishing websites, it is not as
common for the websites to be hosted on compromised machines. It is more likely that they are on a free hosting
ISP, blog, or personal storage.
The rest of the breakdown was as follows; United Kingdom 10%, China 7%, Germany 4.2%, Russia 3.5%, Korea
2.2%, Sweden 1.5%.

Phishing
Phishing Based
Based Keylogger
Keylogger andand Trojan
TrojanDownloaders
Downloaders byby Hosting
Hosting Country
Country
BrazilBrazilUnited
UnitedKingdomKingdomChinaChinaGermany
Germany
RussiaRussiaKorea
KoreaSweden
SwedenUnitedUnitedStates
StatesAnti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

Tumbleweed Message
Protection Lab
The mission of the Tumbleweed
Message Protection Lab is toanalyze current and emerging
enterprise email threats, anddesign new email protection
technologies.

PandaLabs

Websense® Security Labs™

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware. Present in over
50 countries, it offers services
around the clock, 365 days ayear.

Websense Security Labs mission
is to discover, investigate, andreport on advanced Internet
threats to protect employee
computing environments.

For media inquiries please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or Peter Cassidy,APWG Secretary General at 617.669.1123.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft andfraud that result from the growing problem of phishing and email spoofing. The organization provides a forum todiscuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share
information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share thisinformation with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are nearly 900 companies and government agencies participating in the APWG and nearly
1400 members. Note that because phishing attacks and email fraud are sensitive subjects for many organizations that
do business online, the APWG has a policy of maintaining the confidentiality of member organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the website are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco and in June 2004
was incorporated as an independent corporation controlled by its steering committee, its board and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org