Anti-Phishing Working Group
Phishing Attack Trends Report

May, 2004

Phishing attacks use spoofed e-mails and fraudulent websites designed to fool recipients into divulging personal financial
data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking thetrusted brands of well-known banks, online retailers and credit card companies, data suggests that phishers are able toconvince up to 5% of recipients to respond to them. The result of these scams is that consumers suffer credit card fraud,
identity theft, and financial loss.
The Phishing Attack Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group via theorganization’s website, http://www.antiphishing.org or email submission via reportphishing@antiphishing.org. The AntiPhishing Working Group phishing attack repository is the Internet’s most comprehensive archive of email fraud andphishing attacks.

Highlights
••
•
•
•

Number of unique phishing attacks reported in May:
Peak number of unique phishing attacks per week reported in May:
Organization most targeted by phishing attacks in May:
Business sector most targeted by phishing attacks in May:
Percentage of phishing attacks using spoofed email addresses:

1197
321
Citibank (370)
Financial Services
95%

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry
association focused on eliminating the identity theft and fraud that result from the growing problem of phishing andemail spoofing. For further information, please contact Dan Maier at dmaier@antiphishing.org or +1 650-216-2078.
Analysis for the Phishing Attack Trends Report has been donated by the Tumbleweed Communications Message
Protection Lab. The mission of the Tumbleweed Message Protection Lab is to analyze enterprise email threats (e.g.
spam, email fraud, viruses, etc) and design new email protection technologies.

Email Phishing Attack Trends

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Anti-Phishing Working GroupIn May, there were 1197 new, unique phishing attacks reported to the Anti-Phishing Working Group. This
was a relatively minor 6% increase over the number of attacks reported in April (1125). The average numberof phishing attacks per day in May was 38.6 (up slightly from the 37.5 per day for April). Analyzing thisinformation on a weekly basis shows two weeks that averaged over 300 attacks, but a significant dip during
the week of May 29. This may be due to the Labor Day holiday in the U.S., and a resultant reduction inreported phishing attacks.

Who Is Being Targeted By Phishing Attacks?
Most-Targeted Companies

Unique Phishing Attacks by Targeted Company

In May, Citibank was (once again) the company
whose brand was hijacked most often byphishers, although this represents a significant
22% drop in volume from the previous month.
eBay continues to be the target of a large andgrowing volume of phishing attacks (as does
Paypal, which ended up in fourth place thismonth).
U.S. Bank was the third-most attacked brand inMay, with a 170% surge in phishing attacks.
Other notable targets included Visa, with over 20
phishing attacks spoofing its brand, and AOL,
which saw a doubling of phishing attacks.

Phish Target May-04
Citibank
370
eBay
293
U.S. Bank
167
Paypal
149
Fleet
33
VISA
21
AOL
17
LLoyds17
Barclays
15
Westpac12
Nationwide
10
Halifax
9Bank One6
Chase6
Earthlink
6
ANZ
4Natwest4
e-gold3HSBC3MSN
33National West
Woolwich
3Yahoo3

Apr-04
475
22162
135
280
91531
17064318
76530002

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Mar-04
98
110
463
23
7
104
11
100
1
5254
2240
00
3

Feb-04
58
1040
42
98
100
60
000
0
800
200
00
4Jan-043451
2102235
1
1
30
100
90
00
10002

Dec-031733016144
1
1
10010631200000Anti-Phishing Working GroupOver the past 7 months that phishing attacks have been reported to the APWG, its clear that phishers
have focused their efforts on Citibank, eBay and Paypal.

Most-Targeted Industry Sectors
Financial Services remains the most highly targeted industry sector by phishing attacks, both in terms ofoverall number of attacks, as well as number of companies targeted by phishers. The Retail sector(primarily driven by eBay) continues to follow as the next most-attractive industry segment for phishing.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Anti-Phishing Working GroupEMAIL SOURCE ANALYSIS
95% of Phishing Attacks Use Spoofed Email Addresses
In analyzing the “From” address used by phishers for May attacks, we found that at least 95% of themwere ‘spoofed’, or forged. In addition, only a very small percentage of phishing emails actually use “socialengineering” email addresses or non-disguised Webmail addresses.

“Social engineering” email addresses use authentic Internet email domains that look similar to emailaddresses used by the companies they are spoofing. For example, one email address used to spoof Visa
was “support@verify-visa.org”. Note that this is NOT a valid email address for Visa, but is used to try tofool recipients via ‘social engineering’ into disclosing their credit card information. It is likely that somepercentage of the social engineering and Webmail email addresses may also be forged, so the actual
percentage of spoofed phishing emails is likely higher than 95%.
Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Anti-Phishing Working Group
The table below contains example email addresses from each of the three email source classifications weused to analyze the phishing attacks. Note that this analysis used about 80% of the phishing attacks
submitted to the APWG – the rest were not usable for this analysis because they lacked sufficient header
information to analyze the email source:
Spoofed Addresses

Social Engineering Addresses

Webmail Addresses

billing@aol.com
AOLBilling@aol.com
services@aba.com
support@anz.com
customerservice@att.com
Domain@bankone.com
support@barclays.com
users-billing39@barclays.co.uk
chasecreditcards@email.chase.com
support@citibank.com
suspend@ebay.com
aw-confirmation@ebay.com
customers@experian.com
service@fleet.com
users-billing42@halifax.co.uk
users-billing32@lloydstsb.co.uk
support@msn.com

aol@billing.com
update-account@american-on-line.com
citicard@citigrop.com
support@earthlink-verified.com
support@verified-earthlink.net
support@eBay.billing.com
ebay@aw-confirm.com
information@ebay-validation.info
billing@ebay.staff.com
directmail@yahoo-inc.com
support@lloydstsd.co.uk
mso@paypalsecure.com
support@visa-verify.net
support@verify-visa.net
support@verify-visa.org
support@verify-visa.info
wachovia@wachoviaemail.com%MFROM@msn.com
mathieu@compuserve.com
w-e-account@aol.com
vnqtsgzj-chyd@mail.com
dxthncxr-tlwo@lycos.com
zzyxslxs-qtgs@yahoo.com
uqoeyuwl-invi@yahoo.deabcii@earthlink.net
shadowvamp04@yahoo.com.au

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft andfraud that result from the growing problem of phishing and email spoofing. The organization provides a forum todiscuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share
information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share
this information with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are currently over 200 member organizations participating in the APWG. Note that
because phishing attacks and email fraud are sensitive subjects for many organizations that do business online,
the APWG has a policy of maintaining the confidentiality of member organizations.
The Web site of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. The
analysis, forensics, and archival of phishing attacks to the Web site are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org