The first month of 2006 saw a large rise in phishing attack reports in comparison with previous months. This maintains the trend set a year ago. The 17,877 phishing attacks reported in January 2006 were a new high. The previous record lasted just two months, with 16,882 attacks having been reported in November 2005. Interestingly, attackers seem to be choosing to target victims in the leanest month of the year, after the big spend over the festive period.
Another huge jump took place in the number of new unique phishing sites opened in January. This time 9,715 sites were detected, representing a massive increase on the 7,197 sites found in December, and the previous record of 5,295 unique phishing sites reported in August 2005. An explanation for this drastic increased could be the new methods employed by phishers, who have mastered a quick rollout technology with pre-fabricated sites going up in extremely quick time. The one plus point is that the shelf life of a phishing site has once again decreased, this time dropping to an average of 5 days online in comparison with December's 5.3.
Interestingly, the number of brands hijacked by phishers has also dropped from 121 to 101: attackers now seem seem to be focussing their efforts more. This is also highlighted by the fact that 92% of all attacks are now focused on the financial services sector, a growth of nearly 3% on December's figure. The top 10 countries hosting phishing remains virtually the same; one change is China, which now comes second to the US, while Korea dropped into third place. The UK also moved from 5th position in December to 8th, while Romania dropped out altogether, its place being taken byBrazil.
In terms of specific attack methods, the number of password-stealing Trojans has risen slightly from 180 to 184, but this is enough to set a new all-time record. The number of sites hosting these keyloggers has dropped significantly, though, and now stands at 1100, a decrease of 812 on December. The way in which phishing keyloggers differ from ordinary ones is that they have additional tracking components included. These components monitor and log specific activity relating to online financial services, which in turn provides an attacker with easy access to the victim's financial information.
Overall, the report for January 2006 highlights the fact that phishing has not peaked yet, as the number of attacks and unique phishing clone sites is continuing to rise. the fact that the average life of malicious sites has decreased does indicate that better practices and cooperation between different Internet organisations are starting to bear fruit. At the same time, phishing remains a clear and present danger, which will only intensify if the current trend continues.
