Phishing Activity Trends
Report for the Month of February, 2007
Summarization of February Report Findings► The number of phishing reports received by the Anti-Phishing Working Group (APWG) came to 23,610 in February,a drop of over 6,000 from January’s previous record high of 29,930. ► For the first time ever recorded by the APWG,
the United States of America has been surpassed as the top national jurisdiction for the hosting of crimewarespreading websites. China has moved into the top spot with 46.44% of such sites in February and USA dropping tosecond place with 39.24%. ► The APWG saw a total of 135 brands being hijacked in February. That month saw acontinuation of the January trend with many types of websites historically not typically targeted for phishing scams such as social network portals and gambling sites - being spoofed. ► APWG notes that fewer brokerages wereattacked in February than in January. However, more banks, credit unions and a large number of international banks
and brands were spoofed. ► The number of unique websites hosting keyloggers reached an all time high in Februarywith 3,121, up from 1,750 in January and eclipsing the previous record of 2,945 websites hosting keyloggers recordedin June, 2006.

Phishing Defined and Report Scope
Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords, and tocorrupt local and remote navigational infrastructures to misdirect consumers to counterfeit websites and to authentic
websites through phisher-controlled proxies that can be used to monitor and intercept consumers’ keystrokes.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via its member companies, Global Research Partners, the organization’s website at
http://www.antiphishing.org and email submission to reportphishing@antiphishing.org. The APWG phishing attack
repository is the Internet’s most comprehensive archive of email fraud and phishing activity. The APWG additionallymeasures the evolution, proliferation and propagation of crimeware drawing from the independent research of ourmember companies. In the second half of this report are tabulations of crimeware statistics and reportage on specificcriminal software detected by our member researchers.

Statistical Highlights for February 2007••••••••••

Number of unique phishing reports received in February:
Number of unique phishing sites received in February:
Number of brands hijacked by phishing campaigns in February:
Number of brands comprising the top 80% of phishing campaigns in February:
Country hosting the most phishing websites in February:
Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

23610
16463
13514United States
25.4 %
17 %2.5 %4 days30 daysMethodology
APWG is continuing to refine and develop our tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiplecampaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).

Phishing Email Reports and Phishing Site Trends for February 2007
The total number of unique phishing reports submitted to APWG in February 2007 was 23,610, a drop of over 6,000
from the previous month’s record high. This is a count of unique phishing email reports received by the APWG fromthe public, its members and its research partners.

Phishing Reports Received Feb. '06 - Feb. '07
29930

28571

28000
23670

24000
20000

26877

26150

17163

18480

25816

22136

23787

23610

DecemberFebruary

20109
17490

16000
12000
8000
4000
0February

April

June

AugustOctober

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For further
information, please contact APWG Secretary General Peter Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends
Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

The number of unique phishing websites detected by APWG was 16,463 in February 2007.

New Phishing Sites by Month Feb. '06 - Feb. '07
37444 37439
36000
32000
28000

28531 27221

24565

24000
20000
16000
12000

9103

9666 11121 11976 10047

16463

14191
10091

8000
4000
0February

April

June

AugustOctoberDecemberFebruary

Top Used Ports Hosting Phishing Data Collection Servers in February 2007
February saw acontinuation of a trend ofHTTP port 80 being themost popular port used at
96.48% of all phishing sites
reported.

Port 84(1.45%)
Port 82(.9%)
Port 80(96.48%)Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

7 other ports<.2% (1.17%)

Brands & Legitimate Entities Hijacked By Email Phishing Attacks in February 2007
Number ofReported Brands

Hijacked Brands by MonthFeb. '06 - Feb '07

February 2007 showed thesame number of brands
hijacked as January at 135.

160
120
80

137 13010570176

154 14811792120

146 135 135

400Fe

bruaryM
archAprilMay
Ju
neJul
Au y
S e gupt s temb
O erct
N obeovrem
be
D
ecr
em
b
Ja ernu
Fe arybrua
ryContinuing the trend fromJanuary, many types ofwebsites not historicallytargeted by phishers in thepast, such as social network
portals and gambling sites,
were subjected to spoofing inphishing attacks in February.

Most Targeted Industry Sectors in February 2007Financial Services continue to be the mosttargeted industry sector at 92.6% of all
attacks in the month of February.

ISP (3%)

However, fewer brokerages were attacked
in February than January but more banks,
credit unions, and a large number ofinternational banks were spoofed inphishing attacks.

Retail (2.2%)
Miscellaneous(2.2%)

FinancialServices(92.6%)

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends in February 2007
Countries Hosting Phishing Sites
In February, Websense® Security Labs™ saw a continuation of the top three countries hosting phishing websites.
The United States remains the leading phishing website hosting nation with 25.17%. The rest of the top 10 breakdown
is as follows: China 10.16%, Republic of Korea 9.5%, France 4.43%, Germany 4.1%, Japan 3.02%, Russia 2.34%,Netherlands 1.92%, United Kingdom 1.82% and Chile 1.66%.

Top 10 Phishing Sites Hosting Countries
Republic of Korea

FranceGermanyJapanRussia

China

Netherlands
United KingdomChile

United States

PROJECT: Crimeware
Crimeware Taxonomy & Samples According to Classification in February 2007
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Phishing-based Trojans - Keyloggers
Definition: Crimeware code which is designed with the intent of collecting information on the end-user in order tosteal those users' credentials. Unlike most generic keyloggers, phishing-based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions and online
retailers and ecommerce merchants) in order to target specific information, the most common are; access to financial
based websites, ecommerce sites, and web-based mail sites.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Keyloggers; Unique Variants in February

Password Stealing Malicious Code
Unique Applications
400
350
300
250
200
150
100
50
0340 345

289Au
Se gustptem
ber
OctobNov eremb
Dec eremberJanuaFe ry
bruaryJulyFebruaryM
archAprilMayJu
ne192 197 180 215 212 182 172

216 237 230

Phishing-based Trojans – Keyloggers; Unique Websites Hosting Keyloggers in February

Password Stealing Malicious Code URLs
3500
3000

2683

2500

2157

2000 1678
1500

3121

2945
2100

2303
1850

2122

1800 1899

2201
1750

1000
500

AprilM
ay
June
July
Au
Se gu
stptemb
O er
ctobNov eremb
Dec erem
beJa rnu
F e arybrua
rycharM

February0

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS specificinformation, crimeware browser-helper objects that redirect users to fraudulent sites, and crimeware that may install a
network level driver or filter to redirect users to fraudulent locations. All of these must be installed with the intention ofcompromising information which could lead to identify theft or other credentials being taken with criminal intent.
Along with phishing-based keyloggers we are seeing high increases in traffic redirectors. In particular the highest
volume is in malicious code which simply modifies your DNS server settings or your hosts file to redirect either somespecific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server replies with “good”
answers for most domains, however when they want to direct you to a fraudulent one, they simply modify their nameserver responses. This is particularly effective because the attackers can redirect any of the users requests at any
time and the end-users have very little indication that this is happening as they could be typing in the address on theirown and not following an email or Instant Messaging lure.

Phishing-based Trojans & Downloader’s Hosting Countries (by IP address) in February
The chart below represents a breakdown of the websites which were classified during February as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader designed to download a keylogger.
For the first time ever recorded by the APWG, the United States has been surpassed as the top geographic location
for websites marshaled to spread keyloggers or Trojans designed to download keyloggers. China is now in the top spotwith 46.44%.
The rest of the breakdown was as follows; United States 39.24%, Russia 3.4%, France 2.94%, Japan 2.49%,
Germany 2.49%, Brazil 0.92%, Canada 0.78%, Sweden 0.65% and Spain 0.65%.

Top 10 Phishing Based Keylogger and Trojan
Downloaders by Hosting Country
United States

RussiaFranceJapan
Germany
BrazilCanadaSwedenSpainChina

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research ContributorsdMarkMonitor

PandaLabs

Websense Security Labs

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced internet
threats to protect employee
computing environments.

For media inquiries please contact Peter Cassidy, APWG Secretary General at 617.669.1123 or
pcassidy@antiphishing.org and Cas Purdy at 858.320.9493 or cpurdy@websense.com.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraudthat result from the growing problem of phishing and email spoofing. The organization provides a forum to discussphishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share information andbest practices for eliminating the problem. Where appropriate, the APWG will also look to share this information withlaw enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1600 companies and government agencies participating in the APWG andmore than 2600 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the website are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG, a 501c6 tax-exempted corporation, was founded by Tumbleweed Communications and a number ofmember banks, financial services institutions, and e-commerce providers. It held its first meeting in November 2003 in
San Francisco and in June 2004 was incorporated as an independent corporation controlled by its steering committee,
its board and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org