Phishing Attack Trends Report

July, 2004

Phishing attacks use spoofed emails and fraudulent websites designed to fool recipients into divulging personal financial
data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking thetrusted brands of well-known banks, online retailers and credit card companies, data suggests that phishers are able toconvince up to 5% of recipients to respond to them. As a result of these scams, an increasing number of consumers aresuffering credit card fraud, identity theft, and financial loss.
The Phishing Attack Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group (APWG) via
the organization’s website at http://www.antiphishing.org or email submission via reportphishing@antiphishing.org. The
APWG phishing attack repository is the Internet’s most comprehensive archive of email fraud and phishing attacks.

Highlights••••

Number of unique phishing attacks reported in July:
Average monthly growth rate in phishing attacks through July:
Organization most targeted by phishing attacks in July:
Country hosting the most phishing Web sites in July:

1974
50%
Citibank (682)
USA (35%)

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry
association focused on eliminating the identity theft and fraud that result from the growing problem of phishing andemail spoofing. For further information, please contact Kendra Boccelli at kboccelli@mac.com or +1 978-499-0844.
Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Email Phishing Attack Trends
In July, there were 1974 new, unique phishing attacks reported to the APWG. This was a 39% increase overthe number of attacks reported in June (1422). The average number of phishing attacks per day in July was63.7 (up significantly from the 47.4 per day for June). Analyzing this information on a weekly basis shows
every week in July averaged over 395 attacks, with the last week of July breaking the 500 attack level.

Avg. Monthly Growth Rate = 50%

Who Is Being Targeted By Email Phishing Attacks?
Most-Targeted Companies
In July, Citibank was - once again the company whose brand washijacked most often by phishers.
U.S. Bank saw a dramatic 148%
increase, which vaults them into
second place by a significant margin
over eBay, which saw a slightdecrease in phishing attacks overthe month. Other companies
experiencing increases in phishingattacks include AOL, Suntrust,
Earthlink, Wells Fargo and MBNA.
Organizations experiencing
decreases in phishing attacks
include eBay, Paypal, and Fleet.

Unique Phishing Attacks by Targeted Company
Phish Target
Jun-04
Citibank
682
U.S. Bank622
eBay255
Paypal147
AOL41
Suntrust25LLoyds
23
Fleet
20
Barclays
17
Earthlink
15
Wells Fargo
12
Westpac
11Halifax
10MBNA
9
Postbank
9VISA
98
Nationwide inter
HSBC
6
Verizon6
Woolwich6

Jun-04
492
251
285
163
1442455
19
7
1
11
11
40
92
54
3May-04
370
167
293
149
17
1
17
33
15
60
12
9
10
21
10
323

Apr-04
475
62
221
135
95
15
28
31
180
17
6
2000
30
0

Mar-04
98
4110
63
1014
23
11
5
12
10
100
70
400

Feb-04
580
104
42
1000
9680002080000

A “unique phishing attack” in this analysis is defined as a single email blast sent out at one time, targeting one company ororganization, and having one unique subject line. Note that phishers are starting to use common spam techniques to get theseemails past enterprise spam filters, including using multiple different subject lines for a single attack. Therefore, the absolute
numbers of phishing attacks may be slightly overestimated for some companies, particularly the top targets.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Jan-04342511035012190310020100

Most-Targeted Industry Sectors
The most targeted industry sector for phishing attacks continues to be Financial Services, from theperspective of total attacks as well as number of companies targeted. This sector averaged almost 53
reported phishing attacks per day in July. The Retail sector (primarily eBay) continues to follow, although
there are significantly fewer retailers targeted.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends
Countries Hosting Phishing Sites
The United States is once again the ‘leader’ in number of hosted phishing sites, with a growing
percentage of the total. Other countries, including Russia, the UK and Mexico have shown significant
increases in phishing sites hosted as well. Analysis indicates that approximately 35% of phishingwebsites are hosted on exploited machines, unbeknownst to their owners.

Fraud-Based Sites on the Rise
Over the month of July our research indicates a rise in fraud-based websites. Unlike phishing attacks thathijack the brand of established e-commerce or financial institutions, these sites are posing as generic ecommerce sites. The user believes they are ordering legitimate products or applying for a legitimate
mortgage. The most common fraud-based sites seen during July were fake loan scams, mortgage frauds,
online pharmacy frauds, and fake online banking institutions.

Phishing Site Lifecycle
The average “life span” for fraud sites, measured by how long they continue to respond with content, is6.1 days. Note that this lifecycle combines identified phishing sites along with the “fraud” sites discussed
above.
The longest-lived phishing site in this analysis sample is 31 days (in other words, the site was live during
the entire month).

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

Tumbleweed Message Protection Lab

Websense Security Labs

The mission of the Tumbleweed Message Protection
Lab is to analyze current and emerging enterpriseemail threats, and design new email protection
technologies.

Websense Security Labs mission is to discover,investigate, and report on advanced Internet threats toprotect employee computing environments.

Lead investigator:
Dan Maier, dmaier@tumbleweed.com

Lead investigator:
Dan Hubbard, dhubbard@websense.com

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft andfraud that result from the growing problem of phishing and email spoofing. The organization provides a forum todiscuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share
information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share
this information with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are currently over 200 member organizations participating in the APWG. Note that
because phishing attacks and email fraud are sensitive subjects for many organizations that do business online,
the APWG has a policy of maintaining the confidentiality of member organizations.
The Web site of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the Web site are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org