Phishing Activity Trends Report

May, 2006

Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal
consumers' personal identity data and financial account credentials. Social-engineering schemes use 'spoofed' emails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such asaccount usernames and passwords. Hijacking brand names of banks, e-retailers and credit card companies, phishers
often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials
directly, often using key logging systems to intercept consumers online account user names and passwords, and tocorrupt local and remote navigational infrastructures to misdirect consumers to counterfeit websites and to authentic
websites through phisher-controlled proxies that can be used to monitor and intercept consumers’ keystrokes.
The monthly Phishing Activity Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group(APWG) via the organization’s website at http://www.antiphishing.org or email submission toreportphishing@antiphishing.org. The APWG phishing attack repository is the Internet’s most comprehensive archiveof email fraud and phishing activity. The APWG additionally measures the evolution, proliferation and propagation ofcrimeware drawing from the independent research of our member companies. In the second half of this report are
tabulations of crimeware statistics and reportage on specific criminal software detected by our member researchers.

Highlights
••
•
•
•
••
•
•
•

Number of unique phishing reports received in May:
Number of unique phishing sites received in May:
Number of brands hijacked by phishing campaigns in May:
Number of brands comprising the top 80% of phishing campaigns in May:Country hosting the most phishing websites in May:
Contain some form of target name in URL:
No hostname just IP address:
Percentage of sites not using port 80:
Average time online for site:
Longest time online for site:

20,10911,976137
20
United States
46 %
42 %
8%
5.0 days
31 days

Methodology
APWG is continuing to refine and develop our tracking and reporting methodology. We have recently re-instated thetracking and reporting of unique phishing reports (email campaigns) in addition to unique phishing sites. An email
campaign is a unique email sent out to multiple users, directing them to a specific phishing web site, (multiplecampaigns may point to the same web site). APWG counts unique phishing report emails as those in a given monthwith the same subject line in the email.
APWG also tracks the number of unique phishing websites. This is now determined by unique base URLs of thephishing sites.
APWG is also tracking crimeware instances (unique software applications as determined by MD5 hash of thecrimeware sample) as well as unique sties that are distributing crimeware (typically via browser drive-by exploits).
The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry association focusedon eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. For further
information, please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or APWG Secretary General Peter
Cassidy at 617.669.1123. Analysis for the Phishing Attack Trends Report has been donated by the following companies:Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Email Reports And Phishing Site Trends
The total number of unique phishing reports submitted to APWG in May 2006 was 20,109 – a gain of almost a three
thousand attacks from April and is the most ever recorded. This is a count of unique phishing email reports.

Phishing Reports Received May '05 - May '06
20109
20000
16000 14987 15050 14135
13776 13562

15820

17877

16882

17163

18480

17490

15244

12000
8000
4000
0
M ay

July

September

NovemberJanuary

M archM ay

The number of unique phishing websites detected by APWG was 11,976 in May 2006, an increase in unique phishingsites from April and the highest ever recorded by the APWG.

New Phishing Sites by Month May '05 - May '06
12000
11000
10000
9000
8000
7000
6000
5000
4000
3000
2000
1000
0

11121
9715

9103

11976

9666

7197
4280 4564

5259 5242

4367 4630

3326

May

July

September

NovemberJanuaryAnti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

MarchMay

Top Used Ports Hosting Phishing Data Collection Servers
May saw a continuation of a trend of HTTPPort 4443
(4.9%)

port 80 being the most popular port used at92% of all phishing sites reported.

Port 8081(.56%)

Port 81(.56%)
Port 85(.5%)

5 other ports<.5% (1.4%)
Port 80(92%)

Brands and Legitimate Entities Hijacked By Email Phishing Attacks
Number ofReported Brands
May 2006 showed an increaseof brands hijacked than April
2006. This is the most different
types of brands ever recorded by
the APWG.

Hijacked Brands by Month
May '05 - May '06
160
120 107
80

106
74 71

84

121
96 93

137
101 10592
70

40

JuneJuA u lySe gupt stembO erctoNo beve r
De mbce e rmbJa e rnu
Fe a rybruar
M yarchAprilMayMay0

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Most Targeted Industry Sectors
Financial Services continue to be the mosttargeted industry sector, growing to 92% of
all attacks in the month of May.

Retail (1.5%)
ISP (3.6%)
Miscellaneous(2.9%)

FinancialServices (92%)

Web Phishing Attack Trends
Countries Hosting Phishing Sites
In May, Websense® Security Labs™ saw a continuation of the top three countries hosing phishing websites. The
United States remains the on the top of the list with 34.1%. The rest of the top 10 breakdown is as follows – China
15%, Republic of Korea 8.17%, France 3.94%, Germany 3.38%, Japan 2.65%, Malaysia 2.59%, Canada 2.37%, Italy
2.02%, and Brazil 1.7%.

Top 10 Phishing Sites Hosting Countries
Republic o f Ko rea
FranceGermanyChinaJapanM alaysia
CanadaItaly
BrazilUnited States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

PROJECT: Crimeware
Crimeware Taxonomy & Samples According to Classification in April
PROJECT: Crimeware categorizes crimeware attacks as follows, though the taxonomy will grow as variations inattack code are spawned:

Phishing-based Trojans - Keyloggers
Definition: Crimeware code which is designed with the intent of collecting information on the end-user in order tosteal those users' credentials. Unlike most generic keyloggers, phishing-based keyloggers have tracking components
which attempt to monitor specific actions (and specific organizations, most importantly financial institutions and online
retailers and ecommerce merchants) in order to target specific information, the most common are; access to financial
based websites, ecommerce sites, and web-based mail sites.

Phishing-based Trojans – Keyloggers, Unique Variants

Password Stealing Malicious CodeUnique Applications
250200150
100184 192 197 180
174 168
165 180
154
154
142

215

79

ay
M

AprilAu
Se gust
ptem
ber
O
cto
No bervem
De bece rm
beJa rnu
aryFe
brua
ry
M
arch

July

June

M

ay

50
0

Phishing-based Trojans – Keyloggers, Unique Websites Hosting Keyloggers
Password Stealing Malicious Code URLs
30002683

2500
2000
1500
1000500

2157

1912918 958 965 863 104421001678
1100495 526

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.orgAprilM
ayJulAu ySe gustptembO erctobNov eremDbeecem rbe
Ja rnuFe ary
bruaryM
archJuneM
ay0

Phishing-based Trojans – Redirectors
Definition: Crimeware code which is designed with the intent of redirecting end-users network traffic to a location
where it was not intended to go to. This includes crimeware that changes hosts files and other DNS specificinformation, crimeware browser-helper objects that redirect users to fraudulent sites, and crimeware that may install a
network level driver or filter to redirect users to fraudulent locations. All of these must be installed with the intention ofcompromising information which could lead to identify theft or other credentials being taken with criminal intent.
Along with phishing-based keyloggers we are seeing high increases in traffic redirectors. In particular the highest
volume is in malicious code which simply modifies your DNS server settings or your hosts file to redirect either somespecific DNS lookups or all DNS lookups to a fraudulent DNS server. The fraudulent server replies with “good”
answers for most domains, however when they want to direct you to a fraudulent one, they simply modify their nameserver responses. This is particularly effective because the attackers can redirect any of the users requests at any
time and the end-users have very little indication that this is happening as they could be typing in the address on theirown and not following an email or Instant Messaging lure.
Phishing-based Trojans & Downloader’s Hosting Countries (by IP address)
The chart below represents a breakdown of the websites which were classified during April as hosting malicious codein the form of either a phishing-based keylogger or a Trojan downloader which downloads a keylogger.
The United States is still the top geographic location with 44.16%.
The rest of the breakdown was as follows; Portugal 9.66%, Russia 8.52%, Brazil 7.81%, Spain 3.07%, China 2.72%,
Germany 2.45%, Italy 1.93%, Argentina 1.9%, Canada 1.32%.

Top 10 Phishing Based Keylogger and Trojan
Downloaders by Hosting Country
RussiaP o rtugal

B razil
Spain
China
Germany
Italy
A rgentina
CanadaUnited States

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Phishing Research Contributors

dMarkMonitor

PandaLabs

Websense Security Labs™

MarkMonitor is the global leader
in delivering comprehensive
online corporate identity
protection services, with a focus
on making the Internet safe foronline transactions.

PandaLabs is an international
network of research andtechnical support centersdevoted to protecting users
against malware.

Websense Security Labs mission
is to discover, investigate, andreport on advanced Internetthreats to protect employee
computing environments.

For media inquiries please contact Ronnie Manning at rmanning@websense.com or 858.320.9274 or Peter Cassidy,
APWG Secretary General at 617.669.1123.

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraudthat result from the growing problem of phishing and email spoofing. The organization provides a forum to discussphishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share information andbest practices for eliminating the problem. Where appropriate, the APWG will also look to share this information withlaw enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. There are more than 1500 companies and government agencies participating in the APWG andmore than 2400 members. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The website of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks.
The APWG is a 501c6 non-profit organization. It was founded by Tumbleweed Communications and a number ofmember banks, financial services institutions, solutions developers and e-commerce providers. It held its first meetingin November 2003 in San Francisco and in June 2004 was incorporated as an independent corporation controlled byits board of directors and its executives.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org