Phishing Attack Trends Report

June, 2004

Phishing attacks use spoofed e-mails and fraudulent websites designed to fool recipients into divulging personal financial
data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking thetrusted brands of well-known banks, online retailers and credit card companies, data suggests that phishers are able toconvince up to 5% of recipients to respond to them. The result of these scams is that consumers suffer credit card fraud,
identity theft, and financial loss.
The Phishing Attack Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group via theorganization’s website, http://www.antiphishing.org or email submission via reportphishing@antiphishing.org. The AntiPhishing Working Group phishing attack repository is the Internet’s most comprehensive archive of email fraud andphishing attacks.

Highlights
••
•
•
•
•

Number of unique phishing attacks reported in June:
Average monthly growth rate in phishing attacks through June:
Organization most targeted by phishing attacks in June:
Percentage of phishing attacks using spoofed email addresses:
Country hosting the most phishing Web sites in June:
Average lifespan of a phishing site in June:

1422
52%
Citibank (492)92%
USA (27%)
2.25 days

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry
association focused on eliminating the identity theft and fraud that result from the growing problem of phishing andemail spoofing. For further information, please contact Kendra Boccelli at kboccelli@mac.com or +1 978-499-0844.
The following companies have donated analysis for the Phishing Attack Trends Report:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Email Phishing Attack Trends
In June, there were 1422 new, unique phishing attacks reported to the Anti-Phishing Working Group. This
was a 19% increase over the number of attacks reported in May (1197). The average number of phishingattacks per day in June was 47.4 (up significantly from the 38.6 per day for May). Analyzing this information
on a weekly basis shows every week in June averaged over 300 attacks, with the last 4 days of June on
track to continue this trend.

Who Is Being Targeted By Email Phishing Attacks?
Most-Targeted Companies

Unique Phishing Attacks by Targeted Company

In June, Citibank was (once again) thecompany whose brand was hijacked mostoften by phishers, followed by eBay andU.S. Bank. Notable growth rates in attacks
in the month of June include Citibank(33% growth compared to May), U.S.
Bank (50% growth), Fleet (67% growth),
and the addition of FirstUSA as a newphishing target, with 10 attacks. Several
companies experienced declining attacks,including Visa with a 57% reduction, andAOL with a 17% reduction.

Phish Target
Citibank
eBayU.S. Bank
PaypalFleet
LLoydsBarclays
AOL
Halifax
WestpacFirstUsa
VISA
Earthlinke-goldBank One
Bendigo
HSBC
MBNA
Suntrust
Verizon

Jun-04
492
285
251
163
55
24
19
14
11
11
10
9
7
6
5
5
5
4
4
4May-04
370
293
167
149
33
17
15
17
9
120
21
63
6
1
3
1
12

Apr-04
475
221
62
135
28
15
31
9
6
1700
18
540
3
2
50

Mar-04
98
110
4
63
23
4
11
10
1
100
752
50
40
10

Feb-04
58
1040
42
90
6
10000
8
82000
200

Jan-0434
51
21021135
1302
9000
1000

Dec-03
17330
16111
40
10462
100000A “unique phishing attack” in this analysis
is defined as a single email blast sent out
at one time, targeting one company ororganization, and having one unique subject line. Note that phishers are starting to use common spamtechniques to get these emails past enterprise spam filters, including using multiple different subject lines
for a single attack, so the absolute numbers of phishing attacks may be slightly overestimated for somecompanies, particularly the top targets.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Most-Targeted Industry Sectors
The most targeted industry sector for phishing attacks continues to be Financial Services, from theperspective of total attacks as well as number of companies targeted. The Retail sector (primarily eBay)continues to follow, although there are significantly fewer retailers targeted. The Financial Services sector
averaged over 35 reported phishing attacks per company in June.

Email Sender Analysis
In analyzing the “From” address used by phishers for June attacks, we found that at least 92% of themwere ‘spoofed’, or forged. This was down slightly from May, where 95% of attacks used spoofed email
addresses. Once again, only a very small percentage of phishing emails actually use “social engineering”
email addresses or non-disguised Webmail addresses.

“Social engineering” email addresses use authentic Internet email domains that look similar to email
addresses used by the companies they are spoofing. For example, one email address used to spoof Visa
was “support@verify-visa.org”. Note that this is NOT a valid email address for Visa, but is used to try tofool recipients via ‘social engineering’ into disclosing their credit card information. It is likely that somepercentage of the social engineering and Webmail email addresses may also be forged, so the actual
percentage of spoofed phishing emails is likely higher than 92%.
Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends
Note - the following information reflects the analysis of phishing sites during the timeframe of June 15
through June 31.

Countries Hosting Phishing Sites
While the United States is clearly the ‘leader’ in hosting phishing sites, it is interesting that a large numberof phishing sites are hosted in Asia/Pacific countries. This may be due in part to a desire by phishers tohost their forged sites in places where language and time zone barriers make it more difficult for brandowning companies to shut the sites down. Analysis indicates that approximately 25% of phishing websites
are hosted on hacked Web servers, unbeknownst to their owners.

Follow the Money Trail
By figuring out where captured financial information is sent once it is captured from phishing victims, law
enforcement agencies are better able to track down the “money trail” and prosecute these criminals. The
vast majority of information captured from phishing victims is saved to the local web server that hosts thephishing site, and is retrieved periodically by the phisher. Only a small percentage of this information is
automatically sent to some other site or email address. The next step in following the money trail istherefore to trace from what location phishers are logging into phishing site servers to transfer this data.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Site Lifecycle
The average “life span” for phishing sites, measured by how long they continue to respond with content,
is 2.25 days. The longest-lived phishing site in this limited analysis sample is 15 days. We anticipate
getting better site lifecycle data as we accumulate more time series data in the coming months.

Anatomy of a Phish
In the middle of June we started investigating one particular phishing attack. What is interesting from thisanalysis is that identical attack methods were used to exploit two different Banks, even though thephishing attacks were hosted in different locations over time. We feel this indicates the participation of atleast one well-orchestrated, systematic criminal organization in the phishing world.
Date
June 22
June 25
June 28
June 29
June 30
June 31
July 3

Hosting Location
USA, ISP in Plano Texas
Uruguay
S Korea
S Korea
S Korea
USA, ISP Dial-up
S Korea

Site Information
http://199.34.XXX.12:4903/target/index.htm
http://148.244.XXX.93:4903/target/index.htm
http://210.105.XXX.41:4903/target/index.htm
http://210.96.XXX.117:4903/target/index.htm
http://211.232.XXX.227:4901/target/index.htm
http://64.163.XXX.154:4903/target/index.htm
http://211.114.XXX.74:4903/cfm/index.htm

Common Site Characteristics
All sites were hosted on machines that appear to have been exploited by the attacker.
All sites were on hosts that did not have domains registered for them.
All sites were run on non-port 80. Most were on port 4903, but we saw two on port 4901.
All sites were used to exploit financial institutions.
While some “lures” came in via email as an image map other came is as emails with encoded
URL’s in the JavaScript.
All sites used JavaScript to popup a page on top of the original site with the menu items strippedoff.
All of the sites in this analysis were answering as the “SHS” web server. This appears to be a web server
called the Small HTTP Server (see: http://home.lanck.net/mf/srv/index.htm). One hypothesis about thisattack is that it uses zombie machines, with the attacker using Trojan code that hits exploitable machinesand installs the Small HTTP Server, running it for X days until the information is gathered.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

Tumbleweed Message Protection Lab

Websense Security TeamThe mission of the Tumbleweed Message Protection
Lab is to analyze current and emerging enterpriseemail threats, and design new email protection
technologies.

Websense Security Team’s mission is to discover,research, and investigate advanced Internet threats toprotect employee computing environments.

Lead investigator:
Dan Maier, dmaier@tumbleweed.com

Lead investigator:
Dan Hubbard, dhubbard@websense.com

For press inquiries, please contact Kendra Boccelli at kboccelli@mac.com or +1 978-499-0844.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft andfraud that result from the growing problem of phishing and email spoofing. The organization provides a forum todiscuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share
information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share
this information with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are currently over 200 member organizations participating in the APWG. Note that
because phishing attacks and email fraud are sensitive subjects for many organizations that do business online,
the APWG has a policy of maintaining the confidentiality of member organizations.
The Web site of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the Web site are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org