Phishing Bites

The dog days of summer apparently didn't deter phishers. The Anti-Phishing Working Group's latest report for August showed 26,150 unique phishing reports to the organization that month -- nearly 3,000 more than in July. June still holds the record at 28,571.

The number of phishing sites declined, however, from 14,191 in July to 10,091 in August, according to the APWG report released this week.

But the biggest news in the report was that Russia has now passed the U.S. in hosting keylogger and trojan downloaders. Russia had 32.2 percent of these Websites, while the U.S. now has 25.45 percent of them.

Some things seem to never change, though: The U.S. remains the number one country that hosts phishing sites, with 27.88 percent of them, followed by China (14 percent), and the Republic of Korea (9.59 percent), the same top three as last month. And HTTP port 80 is still the hottest port used by phishing sites, at 94.1 percent; and there were 148 new highjacked brands in August, down by just a few from July, when it hit a record 154. Financial services is still the main target of phishing exploits, with 92.6 percent of them.

"The APWG's numbers help show that phishing is still a serious issue that enterprises and ISPs need to be dealing with to protect their employees, customers, and their brands," says David Ulevitch, president of OpenDNS, which recently launched the PhishTank site for checking and reporting potential phishing exploits. (See Phishers Launch Zero-Day Exploits.)

Statistics don't mean much on a practical level, though, say some security experts. "For the most part, trends are academically interesting but have little bearing on what users need to do," says Randy Abrams, director of technical education for Eset. "Phishing is already epidemic. The actions customers have needed to take for a quite a while is no different if phishing attacks increase or decrease."

That means both running security software as well as instilling best practices to avoid falling for a phish, Abrams says. "If phishing disappeared overnight, another social engineering-based attack would spring up to replace it," he says. "The real defense is to learn how not to fall victim to social engineering."

— Kelly Jackson Higgins, Senior Editor, Dark Reading