Phishing Activity Trends Reportrd3 Quarter
2021
Unifying theGlobal Re sponse
T o Cyber cr ime

Table of Contents
Statistical Highlights for 2nd Quarter 2017

3Phishing E-mail Reports and Phishing Site Trends

4Brand-Domain Pairs Measurement

5Brands & Legitimate Entities Hijacked byE-mail Phishing Attacks

6

Use of Domain Names for Phishing

7-9

Phishing and Identity Theft in Brazil

10-11

Most Targeted Industry Sectors

12

APWG Phishing Trends Report Contributors

13Activity July-September 2021

Published 22 November 2021

Phishing Activity Trends Report, 3rd Quarter 2021

Phishing Report Scope
The APWG Phishing Activity Trends Report analyzes
phishing attacks and other identity theft techniques, asreported to the APWG by its member companies, its
Global Research Partners, through the organization’s
website at http://www.apwg.org, and by e-mailsubmissions to reportphishing@antiphishing.org. APWG
measures the evolution, proliferation, and propagation ofidentity theft methods by drawing from the research ofour member companies and industry experts.

Phishing Defined

Phishing Reaches Monthly
Record in Q3; Attacks
Doubled since Early 2020
300,000
250,000

200,000150,000

100,000
50,000Aug-21

Jun-21

Apr-21

Feb-21

Dec-20

Oct-20Aug-20Jun-20

Apr-20Feb-20Dec-190
Oct-19Phishing is a crime employing both social engineering andtechnical subterfuge to steal consumers’ personal identity
data and financial account credentials. Social engineering
schemes prey on unwary victims by fooling them into
believing they are dealing with a trusted, legitimate
party, such as by using deceptive email addresses andemail messages. These are designed to lead consumers tocounterfeit Web sites that trick recipients into divulging
financial data such as usernames and passwords.
Technical subterfuge schemes plant malware onto
computers to steal credentials directly, often using
systems that intercept consumers’ account usernames
and passwords or misdirect consumers to counterfeit
Web sites.

Phishing Activity Trends Summary•

APWG saw 260,642 phishing attacks in July
2021, which was the highest monthly in APWG’sreporting history. [pp. 3-4]

•Table of Contents

The number of phishing attacks has doubled
from early 2020. [pp. 3-4]

Statistical Highlights for 1st Quarter 2021

3

Most-Targeted Industry Sectors

5

Use of Domain Names for Phishing

6

Online Criminal Activity in Brazil

7

APWG Phishing Trends Report Contributors

9•

The software-as-a-service and webmail sector
was the most frequently victimized by phishingin the third quarter, with 29.1% of all attacks.

•Attacks against financial institutions andpayment providers continued to be numerous,
and were a combined 24.9% of all attacks.

•Phishing against cryptocurrency targets –cryptocurrency exchanges and wallet providers– settled at 5.6% of attacks. [p. 5]•The number of brands being attacked has risen
during 2021, from just over 400 per month tomore than 700 in September. [p. 4]

2
Phishing Activity Trends Report
3rd Quarter 2021
www.apwg.org • info@apwg.org•Phishing attacks in Brazil rose, from 4,275 in Q2
to 7,741 in Q3. [p. 7]

Phishing Activity Trends Report, 3rd Quarter 2021
Statistical Highlights for the 3rd Quarter 2021
APWG’s contributing members study the ever-evolving nature and techniques of cybercrime. With thisreport, the APWG has refined the methodologies it uses to report phishing. APWG has two sources ofphishing data: phishing emails reported to it by APWG members and by members of the public, andphishing URLs reported by APWG members into the APWG eCrime eXchange.
The APWG tracks:•Unique phishing sites. This is a primary measure of reported phishing across the globe. This isdetermined by the unique base URLs of phishing sites found in phishing emails reported toAPWG. (A single phishing site may be advertised as thousands of customized URLs, all leading
to basically the same attack, or destination.) APWG is measuring reported phishing sites on amore accurate basis accounting for how phishers have been constructing phishing URLs.

•Unique phishing e-mails subjects. This counts email lures that have different email subject lines.
Some phishing campaigns may use the same subject line but advertise different phishing sites.
This metric is a general measure of the variety of phishing attacks, and can be a rough proxy forthe amount of phishing taking place.

•The APWG also counts the number of brands attacked by examining the phishing reports
submitted into the APWG eCrime Exchange, and normalizing the spellings of brand names.
JulyAugustSept.

Number of unique phishing Web sites (attacks) detected

260,642

255,385

214,345

Unique phishing email subjects

11,384

10,71664,233

522

603

715

Number of brands targeted by phishing campaigns

The number of recent phishing attacks has more than doubled since early 2020, when APWG wasobserving between 68,000 and 94,000 attacks per month. APWG saw 260,642 attacks in July 2021, which
was the highest monthly attack count recorded in APWG’s reporting history.

3Phishing Activity Trends Report
3rd Quarter 2021
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 3rd Quarter 2021

Unique Phishing A�acks, Q4 2019 - 3Q 2021
300,000
250,000
200,000
150,000
100,000
50,000

Oct-19
Nov-19Dec-19Jan-20Feb-20Mar-20
Apr-20May-20Jun-20Jul-20Aug-20
Sep-20
Oct-20Nov-20Dec-20Jan-21
Feb-21
Mar-21
Apr-21
May-21
Jun-21
Jul-21
Aug-21
Sep-210

The number of Unique Subjects has dipped as more submitted emails have had duplicative subject lines.

Brands A�acked, Q1 - Q3 2021
800
700600500
400
3002001000Jan-21Feb-21

Mar-21

Apr-21

May-21

Jun-21

Jul-21

Aug-21

Sep-21

The number of brands attacked each month has trended upwards, to a high of 715 in September 2021.

4Phishing Activity Trends Report
3rd Quarter 2021
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 3rd Quarter 2021
Most-Targeted Industry Sectors – 3rd Quarter 2021
In the third quarter of 2021, APWG founding member OpSec Security found that phishing attacks against
webmail and software-as-a-service (SAAS) providers were most prevalent, exploding from just 8.7
percent of all attacks in Q2 2021 to 29.1 percent of all attacks in Q3. Attacks against financial institutions
and payment providers continued to be numerous, and were a combined 24.9 percent of attacks. Phishingagainst cryptocurrency targets – such as cryptocurrency exchanges and wallet providers – settled at 5.6
percent of attacks, after leaping from 2 percent of all attacks in Q1 to 7.5 percent in Q2. Social Media
rounded out the top-targeted industries.

MOST-TARGETS INDUSTRIES 3Q 2021
Social Media,
11.0%

Payment,
7.1%
Other, 9.3%

eCommerce /Retail, 13.1%

Crypto, 5.6%
Logis�cs /Shipping,
3.5%
Telecom,
3.5%

Financial
Ins�tu�on,
17.8%
SAAS /Webmail,29.1%
OpSesc also reported increased activity with smishing and vishing campaigns, especially targetingcompanies that are app-based, such as email and finance organizations. OpSec noted that its own
monitoring found that Q3 represented a nearly 30 percent increase in total phishing over Q2, and that Q2
represented nearly a 30 percent increase over Q1.
OpSec Security offers world-class brand protection solutions.

5Phishing Activity Trends Report
3rd Quarter 2021
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 3rd Quarter 2021
Use of Domain Names for Phishing
APWG member RiskIQ (now a Microsoft subsidiary) provides ongoing analysis of where phishing ishappening in the domain name system. RiskIQ provides digital attack surface management, providing
discovery, intelligence, and mitigation of threats associated with an organization’s digital presence toprotect businesses, brands, and customers.
RiskIQ analyzed 4,340 confirmed phishing URLs reported to APWG in Q3 2021. RiskIQ found that theywere hosted on 2,649 unique second-level domains (and 18 were hosted on unique IP addresses, withoutdomains). There are three types of top-level domains (TLDs) for purposes of this report:•“Legacy” generic TLDs, which existed before 2011. These include .COM, .ORG, and TLDs such as.ASIA and .BIZ. They represented about 51 percent of the domain names in the world as of thebeginning of Q3 2021, and represented 37 percent of the phishing domains in the sample set. Therewere 993 legacy gTLD domains in the sample set. Most of those were in .COM, which had 845
domains in the set.

•The new generic top-level domains (nTLDs), such as .XYZ and .ICU, were released after 2011. The
nTLDs represented about 6 percent of the domains in the world, but about 9 percent of thedomains in the sample set (249 domains).

•The country code domains (ccTLDs), such as .UK for the United Kingdom and .BR for Brazil.
ccTLDs were about 43 percent of the domains in the world, but were 53 percent of the domains inthe Q3 sample set (1,407 domains).

The TLDs that had the most unique second-level domains used for phishing were:

TLD of Phishing Domains
RiskIQ sample, 3Q 2021
900845

800
700

600
500
400
258

300

232

219

212

203

200

100

82

56

48

48xyz

topbuzz

net

0com

tkgq

ga

6
Phishing Activity Trends Report
3rd Quarter 2021
www.apwg.org • info@apwg.org

mlcf

Phishing Activity Trends Report, 3rd Quarter 2021
The .TK, .GQ, .GA, .ML, and .CF ccTLDs are operated by Freenom, a company in the Netherlands thatoffers free domain name registrations in these TLDs.
During the third quarter, RiskIQ also profiled the bulletproof hosting provider Flowspec, which wasused by threat groups for phishing campaigns and malware delivery“Besides making it harder to get in and limiting the scope of damage, we all need to do a better job ofpreventing ransomware from getting into networks in the first place, and of becoming more resilient. Away to strengthen cybersecurity protection is to mature the Zero Trust security posture of yourorganization,” says Jonathan Matkowsky, a Principal Researcher at Microsoft.
Online Criminal Activity in Brazil
APWG member company Axur is located in Brazil and concentrates on protecting companies and theirusers in Brazil from Internet-based threats. Axur especially monitors attacks against banks, technology
firms, airlines, and online marketplaces located in the country. Axur’s data shows how criminals areperpetrating identity theft in South America’s largest economy, and shows how these incidents are both
local and international problems. Axur’s observations also demonstrate how cybercrime’s intensity andmethods can vary from one locale to another.
In Q3 2021, Axur’s systems identified 7,741 attacks, up from 4,275 in Q2, and 6,209 in Q1:

Phishing A�acks Detected in Brazil Region,
4Q 2020-3Q 2021
4,000
3,500
3,000
2,500
2,000

1,500
1,000
500
07
Phishing Activity Trends Report
3rd Quarter 2021
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 3rd Quarter 2021
Phishing against SaaS and Webmail companies fell back from 40 percent of all attacks in Q2 to 18 percent
of all attacks in Q3. Phishing against e-commerce companies increased from 27 percent to 40 percent of all
attacks:

Phishing in Brazil by Sector,
3Q 2021E-commerce
40%

Banking /Financial
41%

Other
1%

SaaS / Webmail
18%

8
Phishing Activity Trends Report
3rd Quarter 2021
www.apwg.org • info@apwg.org

Phishing Activity Trends Report, 3rd Quarter 2021
APWG Phishing Activity Trends Report Contributors

Axur works to identify and fightAgari by HelpSystems protects

the threats in the cyberspace thatorganizations against phishing,interfere with the interests ofbusiness email compromise (BEC)

companies, governments, andscams, and advanced email threats.

individuals.

OpSec Security offers world-classthreat intelligence and mitigation

PhishLabs provides managed
brand protection solutions.

services that protect brands,
customers, and the enterprisefrom digital risks.

Illumintel provides intelligence,
analysis, due diligence, and public
policy advising in the areas ofcybersecurity and Internet-basedcommerce.

RiskIQ is a digital threat
management company enablingorganizations to discover,understand and mitigate known,
unknown, and malicious exposure
across all digital channels

About the APWG
Founded in 2003, the Anti-Phishing Working Group (APWG) is a not-for-profit industry association focused on
eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware, and email spoofing. Membership is open to qualified financial institutions, online retailers, ISPs, solutions providers,
the law enforcement community, government agencies, multi-lateral treaty organizations, and NGOs. There are
more than 2,000 enterprises worldwide participating in the APWG.
APWG maintains it public website, <http://www.apwg.org>; the website of the STOP. THINK. CONNECT.
Messaging Convention <http://www.messagingconvention.org> and the APWG’s research website<http://www.ecrimeresearch.org>. These are resources about the problem of phishing and Internet frauds – andresources for countering these threats. The APWG, a 501(c)6 tax-exempted corporation, had its first meeting inNovember 2003 in San Francisco, and was incorporated in 2004 as an independent corporation controlled by its
board of directors, its executives and its steering committee.
The APWG Phishing Activity Trends Report is published by the APWG. For further information about the APWG, pleasecontact APWG Deputy Secretary General Foy Shiver (foy@apwg.org, +1.404.434.728). For media inquiries related to thecompany-content of this report, please contact APWG Secretary General Peter Cassidy (pcassidy@apwg.org,+1.617.669.1123); Stefanie Wood at OpSec Security (swood@opsecsecurityonline.com); Angela Tuzzo of Agari by
HelpSystems (atuzzo@mrb-pr.com); Eduardo Schultze of Axur (eduardo.schultze@axur.com,+55 51 3012-2987); Stacy Shelleyof PhishLabs (stacy@phishlabs.com, +1.843.329.7824); Holly Hitchcock of RiskIQ (holly@frontlines.io). Analysis and editing

9by Greg Aaron, Illumintel Inc., www.illumintel.com

Phishing Activity Trends Report
3rd Quarter 2021
www.apwg.org • info@apwg.org