Phishing Activity Trends
Report for the Month of November, 2007
Summarization of November Report Findings► November reported the highest number of hijacked brands ever recorded by the APWG in a single month with 178
discrete corporate identities targeted. The APWG notes an increasing number of financial services industry targets
being reported in Europe and the Middle East in addition to large US banking institutions and credit unions. ► The
total number of unique phishing reports submitted to APWG in November 2007 was 28,074, a decrease of more than
3,500 reports from the previous month, possibly due to an increasing emphasis on targeted phishing attacks against
key executives and employees manifesting last fall. ► The number of unique phishing websites detected by APWG
was 23,630 in November 2007, a decrease of more than 10,600 from the month of October. ► November saw anincrease of nearly 1000 unique websites hosting keyloggers, up to 3500. Financial Services continue to be the mosttargeted industry sector at 93.8% of all attacks in the month of November. ► In November, China overtook the UnitedStates as the top country hosting phishing websites with 24.21%.

Phishing Defined and Report Scope
Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords, and tocorrupt local and remote navigational infrastructures to misdirect consumers to counterfeit websites and to authentic
websites through phisher-controlled proxies that can be used to monitor and intercept consumers’ keystrokes.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via its member companies, Global Research Partners, the organization’s website at
http://www.antiphishing.org and email submission to reportphishing@antiphishing.org. The APWG phishing attack
repository is the Internet’s most comprehensive archive of email fraud and phishing activity. The APWG additionallymeasures the evolution, proliferation and propagation of crimeware drawing from the independent research of ourmember companies. In the second half of this report are tabulations of crimeware statistics and reportage on specificcriminal software detected by our member researchers.

Statistical Highlights for November 2007••••••••••

Number of unique phishing reports received in November:
Number of unique phishing sites received in November:
Number of brands hijacked by phishing campaigns in November:
Number of brands comprising the top 80% of phishing campaigns in November:Country hosting the most phishing websites in November:Contain some form of target name in URL:
No hostname; just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

28074
23630
178
17United States
34.3 %6%.65 %3 days
30 daysMethodology
APWG is continuing to refine and develop our tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiplecampaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).

Phishing Email Reports and Phishing Site Trends for November 2007
The total number of unique phishing reports submitted to APWG in November 2007 was 28,074, a decrease of over
3,500 reports from the previous month. This is a count of unique phishing email reports received by the APWG fromthe public, its members and its research partners.

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry and law
enforcement association focused on eliminating the identity theft and fraud that result from the growing problem of phishing,crimeware and email spoofing. For further information, please contact APWG Deputy Secretary General Foy Shiver at404.434.7282. Data and analyses for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

The number of unique phishing websites detected by APWG was 23,630 in November 2007, a decrease of over
10,600 from the month of October. APWG contributing analysts interpret decreasing numbers of reports ofconventional phishing campaigns and phishing websites last fall as, in part, a precipitate of eCrime gangs’ increasing
focus on targeted phishing attacks against key executives to secure credentials for thefts against corporate assets.
Laura Mather, Senior Scientist at MarkMonitor and Managing Director of Operational Policy for APWG said, “We areseeing executives of companies receiving specially targeted emails that attempt to do two things: 1) Install malware togive the phisher access to the corporations' systems and 2) Gain access to the corporations' bank accounts.”

Top Used Ports Hosting Phishing Data Collection Servers in November 2007
November saw acontinuation of HTTP
port 80 being the mostpopular port used at99.31% of all phishingsites reported.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

April - November 2007 Brand-Domain Pairs Measurement
The following chart combines statistics for the last five months based on brands phished, unique domains, uniquedomain/brand pairs and unique URLs. Brand/domain pairs count the unique instances of a domain being used totarget a specific brand. Example: if several URLs targeting a brand - but are hosted on the same domain - thisbrand/domain pair would be counted as one instead of several. Forensic utility: If the number of unique URLs isgreater than the number of brand/domain pairs, it indicates many URLs are being hosted on the same domain totarget the same brand. Knowing how many URLs occur with each domain indicates the approximate number ofattacking domains a brandholding victim needs to locate and neutralize. Since Phishing-prevention technologies (likebrowser and email blocking) require the full URL, it is useful to understand the general number of unique URLs that
occur per domain.
Laura Mather, Senior Scientist at MarkMonitor and Managing Director of Operational Policy for APWG said, "Aspreviously explained, the best way to take down a domain used only for phishing is to have it removed at the registrar
or registry level. This prevents the bad guy from moving the domain to a new ISP. The APWG is very excited about aproposal we are developing that will define a process for registries and registrars to remove domains used only forphishing from the internet. Some registries are considering implementing our proposal and we think this will be agreat way to combat phishing."

Unique URLs
Unique Domains
Unique Brand-Domain Pairs
Unique Brands
URLs per Brand

April
55643
6637
7622
174
319.79

May
37438
5967
7092
149
251.26

June
31709
6006
7359
146
217.18July30999
6005
7538
126
246.02

August
32079
5023
6580
129
248.67Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

September
28015
5058
6465
92
304.51

October
34226
5472
6704
120285.22

November
23630
5551
6936
178
132.76

Brands & Legitimate Entities Hijacked By Email Phishing Attacks in Nov. 2007
Number ofReported Brands
November’s APWG
trends report had
highest number ofhijacked brands everrecorded by the APWG
in a single month - with178 discrete companies
and agencies, up 2.23%
over the previous high inApril, 2007 and morethan 48% from October.
The APWG noted asubstantial uptick in thenumber of Middle Eastand European financial
services companies
being targeted, some
new to the APWG’sreport log, in addition tolarge US-based banking
institutions and credit
unions.

Most Targeted Industry Sectors in November 2007
Financial Services
continue to be the mosttargeted industry sector
at 93.8% of all attacks inthe month of November.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends in November 2007
Countries Hosting Phishing Sites
In November, Websense Security Labs saw China overtake the United States as the top country hosting phishingwebsites with 24.21%. The rest of the top 10 breakdown is as follows: United States 23.85%, India 9.39%, RussianFederation 8.06%, Thailand 4.64%, Romania 3.53%, Germany 3.41%, Republic of Korea 2.42%, United Kingdom
1.47%, and France with 1.47%.

PROJECT: Crimeware
Crimeware Taxonomy & Samples According to Classification in November 2007
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Phishing-based Trojans - Keyloggers
Definition: Crimeware code which is designed with the intent of collecting information on the end-user in order tosteal those users' credentials. Unlike most generic keyloggers, phishing-based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions and online
retailers and ecommerce merchants) in order to target specific information, the most common are; access to financial
based websites, ecommerce sites, and web-based mail sites.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Keyloggers, Unique Variants in November

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers in November

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS specificinformation, crimeware browser-helper objects that redirect users to fraudulent sites, and crimeware that may install anetwork level driver or filter to redirect users to fraudulent locations. All of these must be installed with the intention ofcompromising information which could lead to identify theft or other credentials being taken with criminal intent.
Along with phishing-based keyloggers we are seeing high increases in traffic redirectors. In particular the highest
volume is in malicious code which simply modifies your DNS server settings or your hosts file to redirect either somespecific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server replies with “good”
answers for most domains, however when they want to direct you to a fraudulent one, they simply modify their nameserver responses. This is particularly effective because the attackers can redirect any of the users requests at any
time and the end-users have very little indication that this is happening as they could be typing in the address on theirown and not following an email or Instant Messaging lure.

Phishing-based Trojans & Downloader’s Hosting Countries (by IP address) in November
The chart below represents a breakdown of the websites which were classified during November as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
The United States continues to be the top hosting country with 68.93%.
The rest of the breakdown was as follows; Russian Federation 13.88%, China 7.88%, Republic of Korea 1.77%,
United Kingdom 1.67%, Poland 1.53%, Germany 1.38%, France 1.13%, Morocco 0.94% and Romania with 0.89%

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

dMarkMonitor

PandaLabs

Websense Security Labs

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced internet
threats to protect employee
computing environments.

For media inquiries please contact APWG Deputy Secretary General Foy Shiver at 404.434.7282 or Cas Purdy at858.320.9493 or cpurdy@websense.com or Te Smith at 831.818.1267 or Te.Smith@markmonitor.com.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraudthat result from the growing problem of phishing and email spoofing. The organization provides a forum to discussphishing issues, define the scope of the phishing problem in terms of hard and soft costs and consequences, andshare information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share
this information with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1700 companies and government agencies participating in the APWG andmore than 3000 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks.
The APWG, a 501c6 tax-exempted corporation, was founded by Tumbleweed Communications and a number ofmember banks, financial services institutions, and e-commerce providers. It held its first meeting in November 2003 in
San Francisco and in June 2004 was incorporated as an independent corporation controlled by its steering committee,
its board of directors and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org