Phishing Activity Trends Report

Q2/2008 Phishing

Committed to Wiping Out
Internet Scams and Fraud

April – June 2008

Phishing Activity Trends Report, Q2 2008
Crimeware-Spreading
Spreading Sites Rise Swiftlyin Q2 – Highest Number Ever Recorded

Phishing Report Scope
The quarterly APWG Phishinghishing Activity Trends Reportanalyzes phishing attacks reported to the APWG by its
member companies, Global Research Partners, theorganization’s website at http://www.antiphishing.org
and by email submissions toreportphishing@antiphishing.org. APWG also measuresthe evolution, proliferation and propagation ofcrimeware drawing from the research of our member
companies. In the last half of this report you will findtabulations of crimeware statistics.

Password Stealing Malicious Code URLs
Q2/2007- Q2/2008

9529

6500

4500
3200
2660

3500
2880 2760

2560

3362

4080
3113

2260

Phishing Defined
Phishing is a criminal mechanism employing both social
engineering and technical subterfuge to steal consumers
consumers’
personal identity data and financial account credentials.
Social-engineering schemes use spoofed e-mails
mails
purporting to be from legitimate businesses and agencies
to lead consumers to counterfeit websites designed totrick recipients into divulging financial data such asusernames and passwords. Technical-subterfuge
subterfuge
schemes plant crimeware onto PCs to steal credentials
directly, often using systems to intercept consumers
online account user names and passwords - and tocorrupt local navigational infrastructures to misdirect
consumers to counterfeit websites (or authentic websites
through phisher-controlledcontrolled proxies used to monitor andintercept consumers’ keystrokes).

The number of crimeware-spreading
spreading sites infecting PCs withpassword-stealing crimeware rose to a high of 9529 in June, fully
47% higher than the previous record of 6500 in March 2008 and258% greater than the end of Q2/2008. Details on page 8.

Q2 2008 Phishing Activity Trends Summary● Unique phishing attack reports submitted to APWG
rose 13 percent during the quarter to 28,151 in June
● Unique phishing websites reported to APWG in Junedecreased more than 9 percent from April to 18,509● May presented a record high of 294 hijacked brands

Table of Contents

and the quarter’s 485 victimized brands is alsoaa record

Statistical Highlights for Q1, 20083

Phishing Email Reports and Phishing Site Trends

4

Brand-Domain Pairs Measurement

5

explained on page 3.]● The category of Other in the ‘Targeted Industry
Segment’ measurement increased to 4 percent of the total

Most Used Ports Hosting Phishing Data
Collection Servers in Q1 2008

high. [Note:: reflects a change in APWG’s data sample,

6

due to attacks against social networking
netw
and national tax
agencies. [Note:: reflects a change in APWG’s data

Brands & Legitimate Entities Hijacked by
Email Phishing Attacks

6

sample, explained on page 3.]

Most Targeted Industry Sectors

7● The number malicious application variants hit a record

Countries Hosting Phishing Sites

7

Phishing-based Trojans – Keyloggers in Q1 20088high of 442 in May

Phishing-based Trojans & Downloader’s Host
Countries (by IP address)

2

9

APWG Phishing Trends Report Contributors:
Websense, Activity
MarkMonitor,& PandaSoftwareQ2 10
Phishing
TrendsReport2008
www.apwg.org ● info@apwg.org● The number of crimeware-spreading
spreading URLs exploded toa record high of 9529 at quarter’s end,end 258 percent higher
than at the end in of Q2 2007

Phishing Activity Trends Report, Q2 2008
Methodology
APWG continues to refine and develop our tracking and reporting methodology and to incorporate new data
sources into our quarterly reports. We have re-instated the tracking and reporting of unique phishing reports (email
campaigns) in addition to unique phishing sites. An email campaign is a unique email sent out to multiple users,
directing them to a specific phishing web site (multiple campaigns may point to the same web site). APWG counts
unique phishing report emails as those in a given month with the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by the unique base URLs of thephishing sites.
APWG additionally tracks crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sites that are distributing crimeware (typically via browser drive-by exploits).
SPECIAL NOTE ON DATA SAMPLING: With this edition the APWG supplements the data sets utilized inestablishing trend lines for the numbers of brands under phishing attack as well as the concentration of those attacks
in targeted industrial sectors, incorporating phishing attack data from APWG member and phish attack data
correspondent MarkMonitor. The APWG Phishing Activity Trends Report is incorporating specifically the company’s‘Unique Brand’ data and attack data delineating industry sectors targeted in those phishing attacks.
The supplemental data augments three report metrics covered in the APWG Phishing Activity Trends Report. Those
are: ‘Brands & Legitimate Entities Hijacked by Email Phishing Attacks’ (Page 6), the ‘Brand-Domain Pairs
Measurement’ (Page 5) and ‘The Most Targeted Industry Sectors’ (Page 7). The MarkMonitor targeted brandsamples averaged around 85 percent more brands than the APWG’s in 2008. The sample size is reflected in the
hijacked brands measurement and the brand-domain pairs metric. The new targeted brand categorization divides
the attack space into five sectors – financial services, auction services, payment services, retail and service companies
and other (which includes government, charities, ISPs and unclassified brands), replacing the APWG’s previous four
categories of financial services, retail, ISPs and government and others.

Statistical Highlights for Q2 2008
April

May

June

Number of unique phishing email reports received by APWG from consumers

24,92423,76228,151

Number of unique phishing web sites detected

20,41020,31718,509Number of brands hijacked by phishing campaigns

276

294

227

Country hosting the most phishing websites

China

TurkeyUS

Contain some form of target name in URL

28.3%

23.2%

26.1%

No hostname; just IP address

5.5%

13.2%

4%

Percentage of sites not using port 80

.81%

.45%

.49%

Longest time online for website

30 days

31 days

30 days3

Phishing Activity Trends Report Q2 2008
www.apwg.org ● info@apwg.org

Phishing Activity Trends Report,

The number of unique phishing reports submitted to
13 percent ending at 28,151 in June, after declining tofrom the yearly high of 30,716 in February by
September of 2007. This represents a count ofPhishing Reports Received April
30000

24924
25000
20000
15000
10000
5000
0
April

The number of unique phishing websites detected by APWG during thedecrease during the month of June to 18,509

4Phishing Activity Trends Report Q2
www.apwg.org ● info@apwg.org

Phishing Activity Trends Report, Q2 2008
Brand-Domain Pairs Measurement for Q2 2008
The following chart combines statistics based on brands phished, unique domains, unique domain/brand pairs, andunique URLs. Brand/domain pairs count the unique instances of a domain being used to target a specific brand.
Example:: if several URLs are targeting a brand – but are hosted on the same domain – this brand/domain pair would
be counted as one instead of several. [NOTE:: Please take note of special note on data sampling on page 3.]
Forensic utility:: If the number of unique URLs is greater than the number of brand/domain pairs, it indicates many
URLs are being hosted on the same domain to target the same brand. Knowing how many URLs occur with eachdomain indicates the approximate
te number of attacking domains a brand
brand-holding
holding victim needs to locate andneutralize. Since Phishing-prevention
prevention technologies (like browser and email blocking) require the full URL, it isuseful to understand the general number of unique URLs that occur pe
per domain.
Phishing Data and Brand-Domain
Domain Pairs for Q2 2008
25,000350

Unique brand-domain
domain pairs steadilydecreased during the period of April
through June, from 7,656 to 6,768.

300
20,000250
15,000200
150

10,000

100
5,000
50
0

0
April

May

June

Unique Phishing Web Sites Detected

Unique Domains

Unique Brand-Domain Pairs

Unique Brands

While the number of unique Phish"While
URL's declined in Q2, the number ofbrands targeted continues to rise," said
saiBlake Hayward, Vice President of
Product Marketing at MarkMonitor.
"This suggests that phishers areinvesting in sophisticated marketing
tools and IT infrastructure in order to
conduct more targeted
rgeted spear phishingcampaigns,” Mr. Hayward said.

URLs per Brand

April

May

June

Number of Unique Phishing Web Sites Detected

20,41020,31718,509Unique Domains

6,176

5,849

5,633

Unique Brand-Domain Pairs

7,656

7,267

6,768

Unique Brands

276

294

227

URLs Per Brand

74

69

82

5

Phishing Activity Trends Report Q2 2008
www.apwg.org ● info@apwg.org

Phishing Activity Trends Report, Q2 2008
Most Used Ports Hosting Phishingng Data Collection Servers in Q2 2008
The second quarter of 2008 saw a continuation of HTTP port 80 being the most popular port used of all phishingsites reported, a trend that has been consistent since APWG began tracking and reporting.

April

May

June

Port 80

99.49%

Port 80

99.42%

Port 80

99.65%

Port 5443.23%

Port 82.16%

Port 443.19%

Port 443.22%

Port 84.06%

Port 84.06%

Port 8080.06%

Port 85.06%

Port 81.03%

Port 443.06%

Port 9070.03%

5 other.24%

1 other.01%

Brands and Legitimate Entities Hijacked by Email Phishing Attacks in Q2 2008
The second quarter of 2008 saw a decrease of 28 percent in hijacked brands from 276 at the beginning of the quarterto 227 brands victimized at period’s end. In the data set used for this metric, May presented a record high of 294
and the quarter’s 485 victimized brands is also a record high. [NOTE:: Please take note of special note on data
sampling on page 3.]

Hijacked Brands by Month Q2 2008
350
300

276

294
227

250
200
150
100
50
0
April

6

Phishing Activity Trends Report Q2 2008
www.apwg.org ● info@apwg.org

May

June

Phishing Activity Trends Report, Q2 2008

Most Targeted Industry Sectors in Q2 2008
inancial Services continues to be the most targeted industry sector during the second quarter of 2008.
2008 This is
Financialconsistent with results since the APWG began tracking targeted industry sectors. The uptick in the ‘Other’ category
is the increase in targeted attacks towards social networking sites such as MySpace and Facebook in addition to tax
agencies. May and June also saw a massive increase in attacks aimed at cell phone providers and manufactures.
manufactures[NOTE: Please take note of special
ecial note on data sampling on page 3.]

Most Targeted Industry Sectors
in Q2 2008
Retail/Service1%

Auction25%

Financial
52%

Payment
Service
18%

Other
4%

Countries
ies Hosting Phishing Sites in Q2 2008
Turkey briefly took the top spot as the country hosting the largest number of phishing sites during the month ofMay. This rise is due to an ISP that was receiving extraordinarily large numbers of phishinging attacks. A hacker
abusing the ISP’s IP space hosted a large number of fraudulent sites there. The United States remained in the top
two of countries throughout the period, regaining the ttop
op spot in June. China made a quick and massive jump to the
top spot in April after only rendering 3% of top countries hosting websites a month before in March.
April

May

June

China

25.19%%

Turkey25.73%

United States

18.93%

United States

16.68%%

United States

17.16%

Turkey17.92%

Russia

8.23%

Japan

11.23%

Poland13.56%

Poland

7.15%

China

9.17%

Greece

6.86%

Turkey5.79%

Poland

7.41%

China

5.87%

Germany

3.97%

Russia3.27%

Russia

4.28%

Republic of Korea

3.12%

Greece2.11%

France

2.48%

Greece2.61%

France2.08%

Republic of Korea

2.38%

France2.32%

Republic of Korea

1.60%

Bulgaria

2.28%

Romania

2.21%

Netherlands

1.60%

United Kingdom

2.16%

7

Phishing Activity Trends Report Q2 2008
www.apwg.org ● info@apwg.org

Phishing Activity Trends Report, Q2 2008
Crimeware Taxonomy and Samples According to Classification
The APWG’s Crimeware statistics categorizes crimeware attacks as follows, though the taxonomy will grow as
variations in attack code are spawned:
Definition: Crimeware code which is designed with the intent of collecting information on the end
end-user in order tosteal those users' credentials. Unlike
ke most generic keyloggers, phishingphishing-based
based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions
institutions, online
retailers, and e-commercecommerce merchants) in order to target sp
specific information. The
he most common types of
information are: access to financial-based
based websites, ecommerce sites, and web
web-basedbased mail sites.

Phishing-based Trojans – Keyloggers in Q2 2008
The number of crimeware-spreading
spreading URLs detectedrose from 4,080 in April to a record 9,529 in June.
This rise represented
esented an increase of nearly 47
percent from the previous record of 6,500 in March,
2008. The number at quarter’s end is 258 percent
higher than the end of Q2 2007.

Password Stealing Malicious Code URLs
12000
9529

10000
8000
6000

Websense Chief Technology Officer and APWG
Phishing Activity Trends Report contributing analyst
Dan Hubbard said that the large boost is attributed
mainly to malicious code being utilized in SQL
injection attacks.

4080
3113

4000
2000
0
April

Password Stealing Malicious Code UniqueApplications
500

438

442
363

400
300
200
100
0
April

May

June

8

Phishing Activity Trends Report Q2 2008
www.apwg.org ● info@apwg.org

May

June

.
eyloggers andan
The number of unique keyloggers
crimeware-oriented malicious applications alsoreached an all-time high this quarter reaching
442 in May,, 1 percent higher than the previous
previorecord the month before and 105 percent higher
than in May 2007 when the number ofcrimeware variants detected was 216.
216 Criminal
hackers have apparently redoubled their efforts
to develop new techniques and scripts to bypass
security measures taken by consumers andenterprises – in addition to increasing thenumbers of crimeware-spreading
spreading websites.
websitesPhishing Activity Trends Report, Q2 2008

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users’ network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS-specificinformation, crimeware browser-helper objects that redirect users to fraudulent sites, and crimeware that may installa network level driver or filter to redirect users to fraudulent locations. All of these must be installed with theintention of compromising information which could lead to identify theft or other credentials being taken withcriminal intent.
Along with phishing-based keyloggers, we are seeing high increases in traffic redirectors. In particular, the highest
volume is in malicious code which simply modifies your DNS server settings or your hosts file to redirect eithersome specific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server replies with“good” answers for most domains; however, when they want to direct you to a fraudulent one, they simply modify
their name server responses. This is particularly effective because the attackers can redirect any of the users requests
at any time and the end-users have very little indication that this is happening as they could be typing in the addresson their own and not following an email or Instant Messaging lure.

Phishing-based Trojans and Downloader’s Hosting Countries (by IP address)

The chart below represents a breakdown of the websites which were classified during Q2 2008 as hosting malicious
code in the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.

April

May

June

United States

38.67%

United States

32.12%

United States

30.98%

China

9.68%

China

28.67%

China

24.95%

Russia

8.23%

Russia

6.06%

Italy

13.34%

Germany

4.10%

Brazil

4.71%

Russia

5.74%

Republic of Korea

3.81%

France

3.10%

Germany

2.56%

Canada2.86%

Germany

2.91%

Brazil

2.45%

France2.46%

Netherlands

2.45%

Republic of Korea

2.17%

Italy

1.96%

Republic of Korea

2.18%

France1.99%

Romania

1.59%

Canada1.61%

Canada1.79%

Poland

1.52%

Italy

1.46%

United Kingdom

1.75%

9

Phishing Activity Trends Report Q2 2008
www.apwg.org ● info@apwg.org

Phishing Activity Trends Report, Q2 2008
Phishing Report Contributors

MarkMonitor, the global

PandaLabs is an international

Websense Security Labs’leader in enterprise brand

network of research andmission is to discover,protection, offers

technical support centers

investigate, and report oncomprehensive solutions anddevoted to protecting users

advanced internet threats toservices that safeguard

against malware.

protect employee computing
environments.

brands, reputation andrevenue from online risks.

The Phishing Attack Trends Report is published quarterly by the APWG, an industry and law enforcement
association focused on eliminating the identity theft and fraud that result from the growing problem of phishing,crimeware, and email spoofing. For further information, please contact APWG Deputy Secretary General Foy
Shiver at 404.434.7282. For media inquiries please contact APWG Secretary General Peter Cassidy at 617.669.1123
or Cas Purdy at 858.320.9493 or cpurdy@websense.com or Te Smith at 831.818.1267 or
Te.Smith@markmonitor.com. APWG thanks its contributing members, above, for data and analyses in this report.

About the APWG
The APWG, founded as the Anti-Phishing Working Group in 2003, is an industry association focused on eliminating theidentity theft and fraud that result from the growing problem of phishing and email spoofing. The organization provides
a forum to discuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs andconsequences, and to share information and best practices for eliminating the problem.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1,800 companies and government agencies participating in the APWG and morethan 3,200 members. Note that because phishing attacks and email fraud are sensitive subjects for many organizations
that do business online, the APWG has a policy of maintaining the confidentiality of member organizations.
The website of the APWG is http://www.antiphishing.org. It serves as a resource for information about the problem ofphishing and electronic frauds perpetrated against personal computers and their users. The APWG, a 501c6 tax-exempted
corporation, was founded by Tumbleweed Communications, financial services institutions and e-commerce providers.
APWG’s first meeting was in November 2003 in San Francisco and in June 2004 was incorporated as an independent
corporation controlled by its steering committee, its board of directors, and its executives.

10

Phishing Activity Trends Report Q2 2008
www.apwg.org ● info@apwg.org