Phishing By The Numbers: 41,000 Blocked Sites in 2005

The Year in PhishingThe Netcraft Toolbar has blocked more than 41,000 confirmed phishing URLs since its launch last Dec. 28. The volume of URLs increased throughout the year, from about 3,000 per month in June to 5,000-plus in September and more than 8,000 in October and November. With a year's worth of data in hand, an analysis of attacks illustrates common patterns and practices in the operation of phishing scams.

Top Targets: eBay and Paypal: The eBay online auction site and its Paypal payment processing unit were the top target for phishing scams in 2005, comprising nearly 62 percent of all phishing URLs submitted to Netcraft. Many of these were "insta-spoofs" served from free sites or cracked machines, often via a botnet. Many of these spoof sites bear identical structures and file titles, suggesting deployment via kits that can be rapidly unpacked on a new machine.

While many of these scams are hosted on IP addresses, the filename often includes the name of the targeted brands or emulates aspects of their URLs. More than 13,000 confirmed phishing sites used URLs that included either "paypal" or "ebay," usually as a subdirectory or filename. Of those, 3,659 used "look-alike" domain names designed to confuse the recipient. These domains included slight misspellings, substituting numbers for letters or using hyphenated phrases or third-level domains (paypal.mysite.com). Nearly 4,700 phishing URLs contained the string "webscr," mimicking the genuine Paypal cgi script. Other URLs included "eBayISAPI," which appears in many eBay searches.

eBay and Paypal have more than 68 million active users between them, all of whom use e-mail, meaning bulk phishing e-mails will get a higher percentage of "hits" (recipients with accounts at the targeted institution) for eBay properties than other potential financial targets.

Phishing URL Trends: Of the total of 41,047 URLs examined in our analysis, the following trends were seen:

  • 13,716 phishing URLs were hosted on raw IP addresses
  • 8,785 phishing URLs contain '/.' (i.e. use a hidden directory on the web server)
  • 2,104 specified a port number other than port 80
  • 8 used cross-site scripting
  • 6 were hosted on FTP servers

Phishing Hosting: Free web hosts continued to be favored location for hosting phishing sites, as seen on Netcraft's Phishiest Hosters page. Also ranking highly were several hosts that seem to offer scant policing of scams, including Romanian host Home.ro/Go.ro, which was home to more than 760 phishing URLs in 2005.

More than 600 phishing spoof sites were hosted on compromised forums and content management systems, offering a reminder that security problems with these programs extend beyond the site's operators and users. Of the phishing sites confirmed by Netcraft, 131 urls contained the phrase "phpbb," 254 contained "forum" and 265 contained "board."

The Geography of Phishing: A review of 5,000 of the most recently confirmed phishing URLs shows that .com continues to be the most popular top-level doman (TLD), with Russia and Romania being the only country-specific TLDs with more than 1 percent of URLs. Here's the breakdown:

urlsbytld.png

Romania has hosted 1,397 phishing sites in 2005, equivalent to about 3.3 percent of all hostnames in that country. Only South Korea (3,807 phishing URLs, or 9.1 percent of all sites) hosts a higher percentage of phishing URLs, with Taiwan (1,276, 3.0 percent) close behind. Additional detail on the geography of phishing can be found at Netcraft's Phishiest Countries page.

The Netcraft Toolbar Community is digital neighborhood watch scheme, in which the most alert and expert members act to defend the larger community of users against phishing frauds. Once the first recipients of a phishing mail have reported the target URL, it is blocked for toolbar users who subsequently access the URL. Widely disseminated attacks (people constructing phishing attacks send literally millions of electronic mails in the expectation that some will reach customers of the bank) simply mean that the phishing attack will be reported and blocked sooner.

The Phishing Site Feed is also available to ISPs and Enterprises who wish to protect their customers or employees against phishing. Netcraft also offers services to detect open redirects on corproate web sites to prevent abuse, and fraud detection and phishing site countermeasure services.