Phishing Activity Trends
Report for the Month of November, 2006
Summarization of November Report Findings►The number of phishing spoof sites continues to remain high with the number of unique phishing URLs being
37,439 in November, a decrease of only five URLs from October. APWG notes that there appears to be a trend oftargeting major financial institutions in waves. This is similar to the attack patterns that were happening in 2004, whenbanks were attacked in waves, according to vulnerabilities or cash-out opportunities for those particular accounts.
► APWG saw a total of 120 brands being hijacked in November with a mix of top US and UK banks in the top 10
targets and a number of smaller banks, though fewer credit unions were attacked during the month. Furthermore,
several major online retailers had their brands spoofed in phishing attacks in November. ► More online brokerages
were spoofed in November 2006 than in any previous month. This may be related to the online pump-and-dump
schemes that have been using phished brokerage accounts to pump up the stock of thinly traded companies. ►APWG continued to see a steady though infrequent number of IRS government phishing attacks. ► The number ofcrimeware variants dropped by only seven to 230, down from last month’s record of 237.

Phishing Defined and Report Scope
Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords, and tocorrupt local and remote navigational infrastructures to misdirect consumers to counterfeit websites and to authentic
websites through phisher-controlled proxies that can be used to monitor and intercept consumers’ keystrokes.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via its member companies, Global Research Partners, the organization’s website at
http://www.antiphishing.org and email submission to reportphishing@antiphishing.org. The APWG phishing attack
repository is the Internet’s most comprehensive archive of email fraud and phishing activity. The APWG additionallymeasures the evolution, proliferation and propagation of crimeware drawing from the independent research of ourmember companies. In the second half of this report are tabulations of crimeware statistics and reportage on specificcriminal software detected by our member researchers.

Statistical Highlights for November 2006••••••••••

Number of unique phishing reports received in November:
Number of unique phishing sites received in November:
Number of brands hijacked by phishing campaigns in November:
Number of brands comprising the top 80% of phishing campaigns in November:Country hosting the most phishing websites in November:Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

25816
37439
12020United States
30 %
12 %
2.8 %
4.5 days
30 daysMethodology
APWG is continuing to refine and develop our tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiplecampaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).

Phishing Email Reports and Phishing Site Trends for November 2006
The total number of unique phishing reports submitted to APWG in November 2006 was 25,816 – an decrease of over
one thousand attacks from October and the fourth highest recorded by the APWG. This is a count of unique phishingemail reports received by the APWG from the public, its members and its research partners.

Phishing Reports Received Nov '05 - Nov '06
28571
23670

24000
20000

26877

26150

28000

16882

16000

15244

17877 17163 18480 17490

20109

25816

22136

12000
8000
4000
0
NovemberJanuary

M archM ay

July

September

November

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For furtherinformation, please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or APWG Secretary General Peter
Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends Report has been donated by the following companies:

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

The number of unique phishing websites detected by APWG was 37,439 in November 2006. Similar to October, wecan see that there are far more phishing emails being sent. In particular, there are more sub-domains being used, in
an attempt to thwart anti-phishing filters by rapidly introducing novel variants.

New Phishing Sites by Month Nov '05 - Nov '06
37444 37439

40000
32000

24565
24000

19660

16000

7197 9715 9103 9666
8000

11121 11976 10047

14191

4630

0
NovemberJanuary

MarchMay

July

September

November

Top Used Ports Hosting Phishing Data Collection Servers in November 2006
November saw a continuation of atrend of HTTP port 80 being the mostpopular port used at 97.17% of allphishing sites reported.

Port 84(.77%)

Port 80(97.17%)Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Port 82(.73%)
Port 81(.37%)

6 other ports <.3%(.96%)

Brands & Legitimate Entities Hijacked By Email Phishing Attacks in Nov. 2006
Number ofReported Brands

200
160
120
80

121
93

13713010110570

176154148

117

120

92

400NoveDe mb
ce e rmb
Ja e rnu
Fe a rybruar
M yarch
April
May
June
JuA u ly
Se gu
pt stembO erct
No o beve rmberNovember 2006 showed aconsiderable drop in the number ofhihacked brands with 120, downfrom the previous month’s recordshattering 176. Of those brands
most all were financial services
firms, with a mix of top US and UK
banks in the top 10 targets as well
as a number of smaller banks.
There were, however, fewer credit
unions attacked during the month.
Furthermore, several major online
retailers had their brands spoofedin phishing attacks in November,
opportunistically leveraging thegift-buying rush of the holidays.

Hijacked Brands by Month
Nov '05 - Nov '06Most Targeted Industry Sectors in November 2006
Financial Services continue to be the mosttargeted industry sector at 91.7% of all attacks
in the month of November. Additionally, ISPs
continue to surpass Retail as a targetedindustry. More online brokerages werespoofed in November 2006 than in any
previous month, accounting for two of thefinancial services brands attacked. The focus
on brokerages may be related to some of theonline pump-and-dump schemes that havebeen using phished brokerage accounts topump up the stock of thinly traded companies.
Scammers would pump up stocks by bothsending promotional spam for sparsely tradedstocks and taking over accounts to buy thestock and temporarily inflate their bourse sellprices.

Retail (2.5%)
ISP (3.3%)
Miscellaneous(2.5%)

FinancialServices(91.7%)

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Web Phishing Attack Trends in November 2006
Countries Hosting Phishing Sites
In November, Websense® Security Labs™ saw a continuation of the top three countries hosing phishing websites.
The United States remains the on the top of the list with 24.2%. The rest of the top 10 breakdown is as follows: China
15.42%, Republic of Korea 14.88%, Germany 5.27%, Romania 2.84%, Russia 2.64%, United Kingdom 2.04%,
France1.83%, Venezuela 1.81%, Brazil1.43%.

Top 10 Phishing Sites Hosting Countries
Republic o f Ko rea
Germany
Ro maniaRussia
United Kingdo mFranceChina
Venezuela
B razil

United States

PROJECT: Crimeware
Crimeware Taxonomy & Samples According to Classification in November 2006
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:Phishing-based Trojans - Keyloggers
Definition: Crimeware code which is designed with the intent of collecting information on the end-user in order tosteal those users' credentials. Unlike most generic keyloggers, phishing-based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions and online
retailers and ecommerce merchants) in order to target specific information, the most common are; access to financial
based websites, ecommerce sites, and web-based mail sites.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing-based Trojans – Keyloggers, Unique Variants in November

Password Stealing Malicious CodeUnique Applications
250
200150184 192 197 180
165 180

215 212182 172216

237 230

AprilM
ay
Ju
ne
Ju
ly
Au
g
Se
u
pt stembO er
cto
No berve
m
ber

Novem
De bece rmbeJa rnu
ar
Feybr
uary
M
ar
ch

100
500

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers in November

Password Stealing Malicious Code URLs
3500
3000
2500

2157

1912

2000
15002945

2683

1044

2100

1678

2303
1850

2122

1800 1899

1100

1000
500

July
Au
Se gustptem
ber
OctobNov erem
berApri l
M
ay
June

Novem
be
Decr
em
be
Ja rnuaFe ry
bruaryM
arch0

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS specificinformation, crimeware browser-helper objects that redirect users to fraudulent sites, and crimeware that may install a
network level driver or filter to redirect users to fraudulent locations. All of these must be installed with the intention ofcompromising information which could lead to identify theft or other credentials being taken with criminal intent.
Along with phishing-based keyloggers we are seeing high increases in traffic redirectors. In particular the highest
volume is in malicious code which simply modifies your DNS server settings or your hosts file to redirect either somespecific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server replies with “good”

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

answers for most domains, however when they want to direct you to a fraudulent one, they simply modify their nameserver responses. This is particularly effective because the attackers can redirect any of the users requests at any
time and the end-users have very little indication that this is happening as they could be typing in the address on theirown and not following an email or Instant Messaging lure.

Phishing-based Trojans & Downloader’s Hosting Countries (by IP address) in November
The chart below represents a breakdown of the websites which were classified during November as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
The United States is the top geographic location with 34.04%.
The rest of the breakdown was as follows; France 7.49%, Brazil 6.42%, Russia 4.06%, Republic of Korea
Germany 2.99%, China 2.78%, United Kingdom 1.92%, Argentina 1.07%, Switzerland .85%.

Top 10 Phishing Based Keylogger and Trojan
Downloaders by Hosting Country
B razilFranceRussia
Republic o f Ko rea
GermanyChina
United Kingdo mA rgentina
Switzerland

United States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

3.21%,

Phishing Research Contributors

dMarkMonitor

PandaLabs

Websense Security Labs™

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced Internetthreats to protect employee
computing environments.

For media inquiries please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or Peter Cassidy,
APWG Secretary General at 617.669.1123.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraudthat result from the growing problem of phishing and email spoofing. The organization provides a forum to discussphishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share information andbest practices for eliminating the problem. Where appropriate, the APWG will also look to share this information withlaw enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1600 companies and government agencies participating in the APWG andmore than 2600 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the website are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG, a 501c6 tax-exempted corporation, was founded by Tumbleweed Communications and a number ofmember banks, financial services institutions, and e-commerce providers. It held its first meeting in November 2003 in
San Francisco and in June 2004 was incorporated as an independent corporation controlled by its steering committee,
its board and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org