Phishing: Phishers are constantly experimenting, looking for better ways to defraud Internet users with new strategies and tactics

[apwg] Phishers are constantly experimenting, looking for better ways to defraud Internet users and reap more money from their crimes. The second half of 2008 found phishers adopting new strategies and tactics. To combat phishing, we seek to better understand how they are using domain names, and why. Domain name usage is an important measure of the scope of the global phishing problem, and examination of domain name system trends can provide effective new anti-abuse tools.

This study describes our analysis of a comprehensive database of the phishing that took place in the second half of 2008 (2H2008), and is a follow-up to our earlier studies of data stretching back to January 2007.

Specifically, this new report examines all the phishing attacks detected between July 1, 2008 and December 31, 2008, as collected by the APWG and supplemented with data from several phishing feeds and private sources. The APWG phishing repository is the Internet’s most comprehensive archive of phishing and email fraud activity.

New to this 2H2008 report is an analysis of how many domain names were registered by phishers, versus phish that appeared on compromised (hacked) domains. These different categories are important because they present different mitigation options for responders, and offer insights into how phishers commit their crimes.

Our data reveals several new trends, and we hope that bringing them to light will lead to improved anti-phishing measures.
Our major findings include:

1. Phishers are increasingly using subdomain services to host and manage their phishing sites. Phishers use such services almost as often as they register domain names. And such attacks even account for the majority of phishing attacks in certain large TLDs. This trend shows phishers migrating to services that cannot be taken down by registrars or registry operators, thereby frustrating some takedowns and extending the uptimes of attacks.
2. Phishers continue to target specific Top-Level Domains (TLDs) and specific domain name registrars, and shift their preferences over time. 2H2008 demonstrated what can happen to registries and registrars who are not prepared to combat phishing with effective policies and procedures.
3. The amount of Internet names and numbers used for phishing has remained fairly steady over the past two years.
4. Anti-phishing programs implemented by domain name registries can have a remarkable effect on the up-times (durations) of phishing attacks.
5. There are decreases in phishing on IP addresses and the use of brand names in domain names to fool users. Phishers are not using IDNs (Internationalized Domain Names).