eBay and its Paypal payment processing unit were the top target for phishing scams in 2005, comprising nearly 62 percent of all phishing URLs submitted to Netcraft. Many of these were “insta-spoofs” served from free sites or cracked machines, often via a botnet. Many of these spoof sites bear identical structures and file titles, suggesting deployment via kits that can be rapidly unpacked on a new machine.

While many of these scams are hosted on IP addresses, the filename often includes the name of the targeted brands or emulates aspects of their URLs. More than 13,000 confirmed phishing sites used URLs that included either “paypal” or “ebay,” usually as a subdirectory or filename. Of those, 3,659 used “look-alike” domain names designed to confuse the recipient. These domains included slight misspellings, substituting numbers for letters or using hyphenated phrases or third-level domains (paypal.mysite.com). Nearly 4,700 phishing URLs contained the string “webscr,” mimicking the genuine Paypal cgi script. Other URLs included “eBayISAPI,” which appears in many eBay searches.

Posted: 01|4|06 at 10:41 am. Filed under: Auction News.