With a full twelve months under our belt, today OpenDNS published the first-ever PhishTank annual report.

The report looks at the more than 300,000 phishes you’ve submitted and helped verify over the course of one year. While some of the report’s findings come as no surprise (e.g., PayPal and eBay round out the top of the list of most spoofed brands), some are alarming. Perhaps the most important finding, and the one that drove us to come up with a fix, is that U.S. telecoms are hosting more phishes than telecoms in any other country.

I think lots of American organizations are led to believe that phishing is something they can do nothing about, aside from simply educating themselves and their people on how to identify phoney emails. Not the case. Starting today we invite all telecoms and other organizations to search PhishTank by their ASN (Autonomous System Number) or brand name. We’ll even deliver information about phishes hosted on their network via a RSS feed. As a hosting provider, once you know about phishes on your network it’s easy to stop them.

Here’s a list of the U.S. telecoms hosting the most phishes, according to PhishTank:

1. SBC - 53,666
2. Comcast - 28,016
3. Roadrunner - 25,925
4. Charter - 12,544
5. Internet Services - 10,332
6. Inktomi Corporation - 9,293
7. XO Communications - 8,511
8. Bresnan Communications - 8,408
9. Advanced Internet Technologies - 8,274
10. Park Region Mutual Telephone Co. - 7,566

Other interesting report findings include:

18 percent of all verified phishing Web sites were hosted on just three IP addresses.

Web sites ending in “.cn” - the Top Level Domain (TLD) assigned to China - account for four of the top five Web sites with the most valid phishes.

One unique phishing scam is launched every two minutes.

You can read the full press releases about the annual report findings here and the new ASN and brand search here.

Thanks to everyone who contributed to what Brian Krebs of the Washington Post today called “one of the most comprehensive data sets ever published on [phishing], offering fascinating insights on the scope and increasing sophistication of phishing attacks.”

May stats are live. Check ‘em out here.

A few things popped out at me. First off, median time to submission dropped by 11 hours down to just 19. And the total number of invalid phishes is only 739 out of more than 53,000. Not only is the community getting faster, it’s also getting more diligent about submitting.

It just keeps getting better and better. Thanks, guys. Keep it up!

Credit card fraud keeps growing on the Net is the headline in the May 11, 2007 version of the International Herald Tribune. PhishTank’s April 2007 statistics earned a mention.

Statistics from Phishtank, an antiphishing network, found that last month alone some 77,709 phishes were sent out, with 19 percent originating in the United States, 15 percent in France, 14 percent in Turkey and 10 percent from South Korea.

“This is a global problem,” said David Ulevitch, the founder of Phishtank, whose data is now being used by Yahoo to help make the Internet safer.

Note: the printer-friendly version has everything on one page. The PhishTank reference is page 2 of the article, otherwise.

It’s the first of the month again and you know what that means….

PhishTank April statistics were posted on the Web site today and the differences between April and previous months are hard not to notice. PhishTank caught 77,709 unique phishes last month and tallied a grand total of 243,500 votes. That’s impressive!

You might notice, too, that new members “antiphishing” and “PhishReporter” came in No. 1 and No. 2, respectively, in the Top Submitters list. Both members represent organizations that did more than their share of submitting in April. The longer median time to verify can be attributed simply to a much greater pool of phishes to verify.

If you’re interested, check out the press release here. Keep it up, phish fighters!

Everyone in the PhishTank community should enjoy the March 2007 statistics, in case you didn’t catch the press release. The median time to verify was down to a shade over 6 hours, from more than 15 hours in February. Pretty speedy!

Click the map for a larger version. The United States widened its “lead” in March as the country hosting the most phishes.

Two notes:

• The spike in verifications on March 9th represents the “unsticking” of a backlogged process, so those verifications actually happened across March 7-9.
• Folks were slowed a bit in both submitting and verifying for a few days due to a domain glitch on March 24.

Marking our fifth phish-fighting month, February 2007 stats are live. The upgrades made to PhishTank in January are paying off: the community was fast in February.

Now that there are several months of PhishTank stats on record, it’s fun to look back at the early days. In October, there were 2,400 community members. Not bad for our first month, but it pales in comparison to the more than 13,000 strong we have now. October saw just over 7,000 submissions. Again, a very impressive start, but nothing like the 25,000 we had last month.

It’s clear. PhishTank works.

January 2007 numbers are the best on record. Kudos to the entire community.

A few things I’d like to call out:

• Both total submissions and total votes jumped nearly 50 percent over December numbers.
• The community continues to grow - in December there were 7,984 members of the PhishTank community. In January there were 11,070.
• We see the growth and are responding. We’ve made server upgrades and completed code profiling and refactoring, all to make PhishTank better and easier to use.
• We asked for help and you came forward. We’re thrilled with the enthusiastic response to David’s blog post. PhishTank has a lot more developing power now, and it’s never too late for you to join the team. If you’re interested send us an email: support at phishtank dot com.

All in all the January numbers are a great start to a new year.

Happy New Year! December statistics are now ready for your viewing pleasure.

Highlights include:

• Total number of votes by the PhishTank community: 94,526
• Total number of unique, suspected phishing scams reported: 20,352
• Country hosting the most phishing sites: United States
• Percentage of phishing sites hosted in United States: 23
• Median time it took for the PhishTank community to verify phishes: 15 hours, 16 minutes

The Tank was a bit slower to verify this month, but that’s probably because of the holidays. And the two dips in verification - on December 9 and December 15 - were due to maintenence.

Enjoy!

Wasting no time at all, we added statistics for November 2006 to our stats page today. We also issued a press release about the Tank’s findings.

Highlights include:

• Total number of votes by the PhishTank community: 93,103
• Total number of unique, suspected phishing scams reported: 18,130
• Country hosting the most phishing sites: South Korea
• Percentage of phishing sites hosted in South Korea: 39
• Median time it took for the PhishTank community to verify phishes: 5 hours, 28 minutes

The big change we noticed from last month’s stats was country of host. In October the country hosting the most phishing sites was the United States with 24 percent. In November it was South Korea, with a much higher 39 percent. Don’t interpret this to mean that phishing is a bigger problem in South Korea than in other countries - it doesn’t mean it’s where the target of the phish is and it doensn’t mean it’s where the phisher sent the e-mail from. It just means it’s where the phishing Web site is being hosted.

If there are additional stats you’d like to see, let us know.

Our first batch of monthly stats are ready, and they look great.

One of the main goals of PhishTank is to provide the community with timely phishing statistics. If you searched for comprehensive, accurate October 2006 phishing stats yesterday, chances are you’d have come up empy handed. Or with August or September 2006 stats, which are good, but hardly current. It was for this reason that we worked hard to get the October stats on the site asap. (Some of the phishes represented in the Oct. stats are still online. That’s fast.)

We’ll do our best to get November stats up on the site on Dec. 1, but I figure for our first go-round, three days into the following month ain’t bad.

Aaron built some awesome graphics to depict the numbers, including my personal favorite - the world map.

We’re interested to know - Are you surprised by any of the stats? Is there anything we left out, that you’re curious about? Are we clear about how we arrived at these numbers?