Phishing Activity Trends Report

October, 2005

Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via the organization’s website at http://www.antiphishing.org or email submission toreportphishing@antiphishing.org. The APWG phishing attack repository is the Internet’s most comprehensive archiveof email fraud and phishing activity. The APWG additionally measures the evolution, proliferation and propagation ofcrimeware drawing from the independent research of our member companies. In the second half of this report aretabulations of crimeware statistics and reportage on specific criminal software detected by our member researchers.

Highlights
•••••
••••
•

Number of unique phishing reports received in October:
Number of unique phishing sites received in October:
Number of brands hijacked by phishing campaigns in October:
Number of brands comprising the top 80% of phishing campaigns in October:Country hosting the most phishing websites in October:Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

15820
4367
966United States
56 %
32 %
5%
5.5 days
31 days

Methodology
APWG is continuing to refine and develop our tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiplecampaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For furtherinformation, please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or APWG Secretary General Peter
Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Email Reports And Phishing Site Trends
The total number of unique phishing reports submitted to APWG in October 2005 was 15,820. This is a major jump ofover 2,000 phishing reports from the 13,562 reported in September - this is a count of unique phishing email reports.

Phishing
Phishing Reports
Reports Received
Received October
October '04'04 -- October
October '05
'05
16000
16000
13468
13468 12883
12845
12845
12883

14987
15050
14987 15050
14411
14411
14135
14135 13776
13776 13562
13562

15820
15820

12000
12000
8975
8975 8829
8829
8000
8000

6957
6957

4000
4000

00

October
October

December
DecemberFebruary
February

April
April

June
June

AugustAugustOctober
October

The number of unique phishing websites detected by APWG was 4210 in October 2005, a considerable drop fromthe previous two month highs.

New Phishing Sites by Month October '04 - October '05
6000

5259 5242

5000

4280

4000

2560 2625

3000

2870 2854

4564

4367

3326

1518 1707

2000

1142
1000
0October

DecemberFebruary

April

June

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

AugustOctober

Top Used Ports Hosting Phishing Data Collection Servers
October saw a continuation of a trend of HTTP port
80 being the most popular port used at 95.09% of allphishing sites reported.

Port 4443(2.64%)
10 other ports< 2% (2.3%)

Port 80(95.09%)Brands and Legitimate Entities Hijacked By Email Phishing Attacks
Number of Reported Brands
In October, the number of reportedly phishedbrands dropped to 96, down from September’s
106 but still a substantial margin greater thanthe mean number over the past 12 months.

Hijacked Brands by Month
January-October
160

107

120
80

64

69

79

79

74

71

84

106 9640

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

AuguSestptem
berO
ctoberJulyMayJuneApri lJanuaFe ry
bruaryM
arch0

Most Targeted Industry Sectors
Retail (2.4%)
ISP (4.8%)

Financial Services continue to be the most targetedindustry sector growing to 86.9% of all attacks.

Miscellaneous(6.0%)

FinancialServices(86.9%)

Web Phishing Attack Trends
Countries Hosting Phishing Sites
In October, Websense® Security Labs™ saw a continuation of the top three countries hosing phishing websites. The
United States remains the on the top of the list with 28.75%, with the top 10 breakdown as follows; China 9.96%,
Republic of Korea 8.4%, Germany 3.7%, Australia 3.65%, Canada 3.6%, Japan 3% United Kingdom 2.75%, Italy
2.22%, India 2.1%

Top 10 Phishing Sites Hosting Countries
Republic o f Ko rea

Germany

Australia
CanadaJapanChina
United Kingdo mItaly
India

United States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

PROJECT: Crimeware
Crimeware Taxonomy & Classification Details
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Phishing-based Trojans - Keyloggers
During the month of October, Websense Security Labs have witnessed an increase in the number of variants ofkeyloggers, but a large decrease of password stealing malicious code URLs.

Phishing-based Trojans – Keyloggers, Unique Variants

Password Stealing Malicious CodeUnique Applications
200

154

174

168

79

77

100

154

142

150

50

Se
ptem

O
ctober

be
rt
Au
gus

Ju
ly

Ju
ne

M

ay

Ap
ril0

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers

Password Stealing Malicious Code URLs
1200918

1000
800
495

600
400200965958863526260

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Octoberber
Se
ptemt
Augus

July

JuneayM

April0Phishing-based Trojans & Downloader’s Hosting Countries (by IP address)
The chart below represents a breakdown of the websites which were classified during October as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
The United States is still the top geographic location with 29.9%, Spain continues to grow to 17.08%.
The rest of the breakdown was as follows; Brazil 16.89%, Spain 17.08%, Russia 5.82%, China 4.66%, Germany
4.07%, Korea 2.33%, UK 2.13%, Canada 2.13%, Sweden 1.55%

Top 10 Phishing Based Keylogger and Trojan
Downloaders by Hosting Country
Spain

ChinaKorea
UKRussia
Germany

BrazilCanadaSweden

United States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

dMarkMonitor

PandaLabs

Websense® Security Labs™

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced Internet
threats to protect employee
computing environments.

For media inquiries please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or Peter Cassidy,
APWG Secretary General at 617.669.1123.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft andfraud that result from the growing problem of phishing and email spoofing. The organization provides a forum todiscuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share
information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share thisinformation with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1300 companies and government agencies participating in the APWG andmore than 2000 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. Theanalysis, forensics, and archival of phishing attacks to the website are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco and in June 2004
was incorporated as an independent corporation controlled by its steering committee, its board and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org