Phishing Activity Trends Report

1 Quarter
2019
stUni f yin g th e
Glo bal Res po ns e
To C yb er cr im e
Table of Contents
Statistical Highlights for 2nd Quarter 20173

Phishing E-mail Reports and Phishing Site Trends

4

Brand-Domain Pairs Measurement

5

Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13

Activity January-March 2019

Published May 15, 2019

Phishing Activity Trends Report, 1st Quarter 2019
Phishing of SaaS and Webmail Brands
Surpasses Payment Brands for First Time

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing attacks reported to the APWG by its member
companies, its Global Research Partners, through theorganization’s website at http://www.apwg.org, and bye-mail submissions to reportphishing@antiphishing.org.
APWG also measures the evolution, proliferation, andpropagation of crimeware by drawing from the researchof our member companies.

Phishing Defined
Phishing is a criminal mechanism employing both socialengineering and technical subterfuge to steal consumers’
personal identity data and financial account credentials.
Social engineering schemes use spoofed e-mails
purporting to be from legitimate businesses andagencies, designed to lead consumers to counterfeit Web
sites that trick recipients into divulging financial datasuch as usernames and passwords. Technical subterfuge
schemes plant crimeware onto PCs to steal credentials
directly, often using systems to intercept consumers
online account user names and passwords -- and tocorrupt local navigational infrastructures to misdirect
consumers to counterfeit Web sites (or authentic Web
sites through phisher-controlled proxies used to monitor
and intercept consumers’ keystrokes).

1st Quarter 2019 Phishing Activity Trends Summary•

Phishing that targeted Software-as-a-Service (SaaS)and webmail services became the biggest categoryof phishing. At 36 percent of all phishing attacks,
it eclipsed phishing against the payment services
category for the first time. [p. 5]•The total number of phishing sites detected by
APWG in the first quarter of 2019 was up notably
over the third and fourth quarters of 2018. [p. 4]•The number of phishing attacks hosted on Web
sites that have HTTPS and SSL certificates reached
a new high. [p. 6]•In Brazil, mobile phishing rose, and phishers also
attacked SaaS providers. Cybercriminals also
deployed malware that targeted multiple banks ata time. [p. 7]

Table of Contents
Statistical Highlights for 4th Quarter 20183

Phishing Site and Phishing E-mail Trends

4

Most-Targeted Industry Sectors

5

How Phishers use Encryption to Fool Users

6

Phishing and Identity Theft in Brazil

7

APWG Phishing Trends Report Contributors

92
Phishing Activity Trends Report
1st Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 1st Quarter 2019
Statistical Highlights for 1st Quarter 2019
JanuaryFebruary

March

Number of unique phishing Web sites detected

48,66350,983

81,122

Number of unique phishing e-mail reports (campaigns)

34,63035,36442,399

327

288

330

received by APWG from consumers
Number of brands targeted by phishing campaigns

The APWG continues to refine its tracking and reporting methodology and to incorporate new data
sources into our reports.
The APWG tracks the number of unique phishing Web sites. This is now determined by the unique baseURLs of the phishing sites. (A single phishing site may be advertised as thousands of customized URLs,
all leading to basically the same attack destination.) APWG’s contributing members report phishing URLs
into APWG. The contributing members also track a variety of additional metrics and data sets in order totrack the fast-paced nature of cybercrime.
APWG also tracks and reports the number of unique phishing reports (email campaigns) it receives fromconsumers. An e-mail campaign is a unique e-mail sent out to multiple users, directing them to a specificphishing web site (multiple campaigns may point to the same web site). APWG counts unique phishing
report e-mails as those found in a given month that have the same email subject line.

3
Phishing Activity Trends Report
1st Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 1st Quarter 2019
Phishing Site and Phishing E-mail Trends – 1st Quarter 2019
The total number of phishing sites detected by APWG in 1Q was 180,768. That was up notably from the138,328 seen in 4Q 2018, and from the 151,014 seen in 3Q 2018.

Phishing Sites, 4Q218-1Q2019
90,00080,00070,00060,00050,00040,00030,00020,00010,0000Oct-18

Nov-18Dec-18Jan-19Feb-19Mar-19The number of unique phishing reports submitted to APWG during 1Q 2019 was 112,393. These werephishing emails submitted to APWG, and exclude phishing URLs reported by APWG members directly into
APWG’s eCrime eXchange.

Unique Phishing Reports Received fromConsumers, 1Q2019
45,00040,00035,00030,00025,00020,00015,00010,0005,000
0Jan-19

Feb-19Mar-19

4Phishing Activity Trends Report
1st Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 1st Quarter 2019
Most-Targeted Industry Sectors – 4th Quarter 2018
In 1Q 2019, APWG member MarkMonitor saw phishing that targeted Software-as-a-Service (SaaS) andwebmail services jump to 36 percent of all phishing attacks. That’s up significantly from 30 percent in 4Q
2018 and 20.1 percent in 3Q 2018. Phishing against the SaaS and webmail category became the biggest
category of phishing, eclipsing phishing against the payment services category for the first time.
Attacks against cloud storage and file hosting sites continued to drop, decreasing from 11.3 percent of all
attacks in Q1 2018 to just 2 percent in 1Q 2019. Founding APWG member MarkMonitor is an online brandprotection organization, securing intellectual property and reputations through anti-fraud, brandprotection, domain management, and anti-piracy solutions.

MOST-TARGETED INDUSTRY SECTORS,
1Q2019SAAS /
Webmail36%
Payment
27%

eCommerce /Retail3%
Telecom
3%

Other
15%

FinancialInstitution
16%

5
Phishing Activity Trends Report1st Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 1st Quarter 2019How
were Phishers
in .COM,Use Encryption to Fool Victims
APWG contributor PhishLabs has been tracking the numbers of phishing sites protected by the HTTPS
encryption protocol. HTTPS is used to secure communications by encrypting the data exchanged between
a person’s browser and the web site he or she is visiting. HTTPS is especially important on sites that offer
online sales or password-protected accounts. Studying HTTP on phishing sites provides insight into howphishers are fooling Internet users by turning an Internet security feature against them (typically by using
the HTTPS protocol’s lock icon in the browser address bar to assure users that the domain itself is ‘safe’).
PhishLabs provides managed security services that help organizations protect against phishing attacks
targeting their employees and their customers.
“In Q1 2019, 58 percent of phishing sites were using SSL certificates, a significant increase from the priorquarter where 46 percent were using certificates,” said John LaCour, CTO of PhishLabs. “There are tworeasons we see more. Attackers can easily create free DV (Domain Validated) certificates, and more web
sites are using SSL in general. More web sites are using SSL because browser warning users when SSL isnot used. And most phishing is hosted on hacked, legitimate sites.”% of Phishing Attacks Hosted on HTTPS
60%% OF PHISHING ATTACKS

50%
40%
30%
20%
10%
0%

Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q12015 2015 2015 2015 2016 2016 2016 2016 2017 2017 2017 2017 2018 2018 2018 2018 20196Phishing Activity Trends Report1st Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 1st Quarter 2019
Online Criminal Activity in Brazil
APWG member company Axur is located in Brazil and concentrates on protecting companies and theirusers in Brazil from Internet-based threats. Axur especially monitors attacks against banks, technology
firms, airlines, and online marketplaces located in the country. Axur’s data shows how criminals areperpetrating identity theft in South America’s largest economy, and shows how these incidents are both alocal and international problems.
In the first quarter of 2019, Axur observed 3,220 cases of phishing and 180 cases of malware. Specifically,
these were attacks against Brazilian brands or against foreign services that are available in Portuguese inBrazil.
In Brazil, the amount of phishing -- especially mobile phishing -- increased in the first quarter of 2019:

Phishing and Malware Detections,
Brazil, 4Q2018-1Q2019
1400
1200
1000
800
600
400
2000
Oct-18

Nov-18Dec-18Phishing

Jan-19Feb-19Mar-19MalwareEach kind of malware identified during this period, on average, aimed to affect up to thirteen Brazilian
financial institutions and their customers. The largest number of targets found in a single malware device
was nineteen.

7
Phishing Activity Trends Report
1st Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 1st Quarter 2019
The phishing that Axur tracked in Brazil was often directed against SaaS and webmail targets:

Phishing by Volume and Sector, Brazil, 1Q 2019
1,200

1,000

800

600

400

2000.

Jan-19Other

E-commerce

Feb-19Banks/Financial Institutions

Mar-19

SaaS/Webmail

8
Phishing Activity Trends Report
1st Quarter 2019www.apwg.org • info@apwg.org!

Phishing Activity Trends Report, 1st Quarter 2019
APWG Phishing Activity Trends Report Contributors

Axur works to identify and fightthe threats in the cyberspace thatinterfere with the interests ofcompanies, governments, andindividuals

MarkMonitor, a global leader inenterprise brand protection, offers
comprehensive solutions andservices that safeguard brands,reputation and revenue fromonline risks.

iThreat provides risk data,
intelligence tools, and analysis tohelp its clients protect theirintellectual & Internet properties.

PhishLabs provides 24/7
managed security services that
help organizations protect
against phishing attacks targeting
their employees and customers.

RiskIQ is a digital threat
management company enablingorganizations to discover,understand and mitigate known,
unknown, and malicious exposure
across all digital channels

About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focused on
eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware, and email spoofing. Membership is open to qualified financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multi-lateral treaty organizations, and NGOs. There are
more than 2,000 enterprises worldwide participating in the APWG.
APWG maintains it public website, <http://www.antiphishing.org>; the website of the STOP. THINK.
CONNECT. Messaging Convention <http://www.stopthinkconnect.org> and the APWG’s research website<http://www.ecrimeresearch.org>. These are resources about the problem of phishing and Internet frauds– andresources for countering these threats. The APWG, a 501(c)6 tax-exempted corporation, had its first meeting inNovember 2003 in San Francisco and was incorporated in 2004 as an independent corporation controlled by its
board of directors, its executives and its steering committee.
The APWG Phishing Activity Trends Report is published by the APWG. For further information about the APWG, pleasecontact APWG Deputy Secretary General Foy Shiver at +1.404.434.7282 or foy@apwg.org. For media inquiries related to thecompany-content of this report, please contact APWG Secretary General Peter Cassidy at +1.617.669.1123; Stefanie Ellis atStefanie.ellis@markmonitor.com; Eduardo Schultze of Axur at +55 51 3012-2987, eduardo.schultze@axur.com; Stacy Shelleyof PhishLabs at 1.843.329.7824, stacy@phishlabs.com, Kari Walker of RiskIQ at +1.703.928.9996, Kari@KariWalkerPR.com,

9+1.703.928.9996. Analysis and editing by Greg Aaron, iThreat Cyber Group.

Phishing Activity Trends Report
PWG thanks
its contributing members, above, for the data and analyses in this report0.
1st Quarter
2019
www.apwg.org • info@apwg.org!