Phishing Activity Trends Report

November, 2005

Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via the organization’s website at http://www.antiphishing.org or email submission toreportphishing@antiphishing.org. The APWG phishing attack repository is the Internet’s most comprehensive archiveof email fraud and phishing activity. The APWG additionally measures the evolution, proliferation and propagation ofcrimeware drawing from the independent research of our member companies. In the second half of this report aretabulations of crimeware statistics and reportage on specific criminal software detected by our member researchers.

Highlights
•••••
••••
•

Number of unique phishing reports received in November:
Number of unique phishing sites received in November:
Number of brands hijacked by phishing campaigns in November:
Number of brands comprising the top 80% of phishing campaigns in November:Country hosting the most phishing websites in November:Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

16882
4630
936United States
49 %
33 %
6%
5.5 days
30 days

Methodology
APWG is continuing to refine and develop our tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiplecampaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For furtherinformation, please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or APWG Secretary General Peter
Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Email Reports And Phishing Site Trends
The total number of unique phishing reports submitted to APWG in November 2005 was 16,882 - a considerable
jump up from October - this is a count of unique phishing email reports.

Phishing Reports Received November '04 - November '05
16000
12845

13468

14411

14987 15050

12883

15820

16882

14135 13776
13562

12000
8975

8829

8000

4000

0
NovemberJanuary

M archM ay

July

September

November

The number of unique phishing websites detected by APWG was 4630 in November 2005, increasing again after
falling substantially in the October report.

New Phishing Sites by Month November '04 - November '05
6000

5259 5242

5000

4280

4000

2560 2625

3000
2000

1518

2870 2854

4564

4367

4630

3326

1707

10000November

January

MarchMayJuly

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

September

NovemberTop Used Ports Hosting Phishing Data Collection Servers
November saw a continuation of a trend of HTTP
port 80 being the most popular port used at
94.55% of all phishing sites reported.

Port 680(1.43%)
8 other ports<1% (4%)

Port 80(94.55%)

Brands and Legitimate Entities Hijacked By Email Phishing Attacks
Number of Reported
Brands

160

107

120
80

64 6979

79

106
74 71

84

96

9340

AuguSestptem
berOctoberNovember

JulyJuneay
MApril0JanuaryFe
bruaryM
arch

Interestingly we are seeingsome larger financial
institutions and internet
retailers experiencing arenewed round of intense
phishing attacks. We continue
to see an increase ininternational phishing,particularly in the UK andEurope.

Hijacked Brands by Month
January-November

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Most Targeted Industry Sectors
Retail (2.2%)
ISP (3.2%)

Financial Services continue to be the mosttargeted industry sector growing to 90.3% of all
attacks. Notably there was a phishing scamusing the Internal Revenue Service as a lure.

Miscellaneous(4.3%)

FinancialServices(90.3%)

Web Phishing Attack Trends
Countries Hosting Phishing Sites
In November, Websense® Security Labs™ saw a continuation of the top three countries hosing phishing websites.
The United States remains the on the top of the list with 32.96%, with the top 10 breakdown as follows; Republic ofKorea 11.34%, China 8.04%, Germany 3.85%, United Kingdom 2.91%, India 2.83%, Canada 2.42%, Japan 2.23%,Romania 1.96%, Russian Federation 1.96%

Top 10 Phishing Sites Hosting Countries
ChinaGermany
United Kingdo mRepublic o f Ko rea
IndiaCanadaJapanRo mania
Russian Federatio nUnited States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Tactic Trends
During November criminals made several new attempts to dupe users into divulging confidential information. One
new attack was one on Google.com. Users were redirected to a spoofed copy of Google's front page with a large
message claiming "You WON $400.00 !!!". Users were presented with instructions for collecting their prize money.
These instructions direct users to enter their credit card number and shipping address. Once the information has
been collected and stolen, users were then seamlessly directed to Google's legitimate website.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

PROJECT: Crimeware
Crimeware Taxonomy & Classification Details
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Phishing-based Trojans - Keyloggers
During the month of November, Websense® Security Labs™ witnessed an increase in the number of variants ofkeyloggers and a major increase of over 180 password stealing malicious code URLs.

Phishing-based Trojans – Keyloggers, Unique Variants

Password Stealing Malicious CodeUnique Applications
200

154

174

168

142

150
79

77

100

165

154

50

ber
No
vem

O
ct
ober

be
r

t

Se
pt
em

Au
gus

Ju
ly

June

M

ay

Ap
ril0

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers

Password Stealing Malicious Code URLs
1200

918

1000
800
495

600
400
200

965

958

1044
863

526

260

Anti-Phishing Working Grouphttp://www.antiphishing.org ● info@antiphishing.org

ber
NovemO
ctober

bert

Se
ptem

AugusJulyJu
neay
MApril0More Sophisticated Trojans and Infection Methods
Malicious code designed for keylogging consumer data, such as user names and passwords, continues to grow at a
rapid and alarming pace. In November, Websense® Security Labs™ saw several cases in which commercial
websites were compromised and exploit code was placed on them to infect users with Trojan Horse keyloggers uponconnecting to the site. The keyloggers usually monitor a consumer’s web surfing behavior and capture keystrokes
upon visiting popular online institutions.
A good example of this scheme was exhibited by an attack on the ShangHai Huizhong Automotive Manufacturing(SHAC) company, a joint venture between VW and the state-owned manufacturing company and one of the largest
car manufacturers in China. Crackers programmed the site to deliver keyloggers to the PCs of consumers visiting theSHAC site, installing a system that attempted to load the malicious code on the visitor’s PCs and run it.
An IFRAME was added to the bottom of the front page. It tried to use a Microsoft® Internet Explorer CHM (compiledWindows HTML Help file) exploit that allows malicious code to be downloaded and run without user intervention.
The website, which was hosted in Australia, downloaded a file called "help.txt", which is not a text file but a CHM
Windows® Help file. This malicious Windows Help file dropped another file called fu**snow.exe, which was packed
with a packing system called UPX (Ultimate Packer for Executables). That file in turn uses several built-in Windows
APIs to connect to the internet, open a back door, and install the keylogger.

Code discovered in IFRAME

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Redirectors
Along with phishing-based keyloggers, we are seeing high increases in traffic redirectors. In particular the highest
volume is in malicious code which simply modifies a PC user’s DNS server settings or host file to redirect either somespecific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server replies with valid
responses for most domains. However when the phishers want to direct a consumer to a fraudulent site, such as acounterfeit version of a bank website, they simply modify the name server’s response for that specific domain. This isparticularly effective because the attackers can redirect any of the user’s requests at any time with little indication ofskullduggery as the user could be typing in the address on their own (a “best practice” in another era) and not
following a link in an email or instant messaging lure (considered high-risk behavior).
Details on Paypal DNS redirector: This Trojan Horse was not detected by any anti-virus vendors and the malicious
DNS server was hosted in Romania while the phishing server was hosted in India. The attack begins with a spoofedemail phishing message that provides a link to download the executable "PayPal security tool" file. The executable,
named 'PayPal-2.5.200-MSWin32-x86-2005.exe', is a Trojan Horse which modifies the DNS server of the local
workstation. Then the Trojan executable deletes itself. All future requests for 'paypal.com' will be transparently
redirected to a phishing website. This same DNS server could also be used to redirect requests for additional
websites, but it currently appears to only redirect 'paypal.com'.
The next time the user attempts to visit the PayPal website, they will instead arrive at a phishing site. The web
address shown in the browser's toolbar will appear to be correct. Upon log in, the phishing site will request the user
update their account. They are prompted to enter the following information: Name, Credit/ATM Card, Billing Address,
Phone Number, Social Security Number, Mother's Maiden Name, Date of Birth, Driver's License, and Bank
Account/Routing Numbers.
The Trojan Horse was not detected by any anti-virus vendors. The malicious DNS server was hosted in Romania
while the phishing server was hosted in India.
Sample phishing email screenshot:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans & Downloader’s Hosting Countries (by IP address)
The chart below represents a breakdown of the websites which were classified during November as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
The United States is still the top geographic location with 31.89%, Spain continues to grow to 22.7%.

The rest of the breakdown was as follows; Brazil11.5%, China 8%, Netherlands 6%, Korea 4%, Germany
3%, Canada 3%, Russia 3%, France 1%

Top 10 Phishing Based Keylogger and Trojan
Downloaders by Hosting Country
BrazilChinaNetherlands
Korea
GermanySpainCanadaRussiaFranceUnited States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

dMarkMonitor

PandaLabs

Websense Security Labs™

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced Internet
threats to protect employee
computing environments.

For media inquiries please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or Peter Cassidy,
APWG Secretary General at 617.669.1123.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraudthat result from the growing problem of phishing and email spoofing. The organization provides a forum to discussphishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share information andbest practices for eliminating the problem. Where appropriate, the APWG will also look to share this information withlaw enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1300 companies and government agencies participating in the APWG andmore than 2100 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the website are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco and in June 2004
was incorporated as an independent corporation controlled by its steering committee, its board and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org