Brand abuse is increasing, but more important than the sheer volume is the increased sophistication and the opportunistic nature of brandjackers, who are quick to take advantage of current events and popular concerns.

Photo credit: Tyler Olson

As a matter of fact, so-called "brandjackers" continue to exploit the confusion over the financial markets that began in the last quarter of 2008 to prey upon vulnerable consumers, and such online scams continue to be quite sophisticated and difficult to detect for the unsuspecting Internet user.

Not only.

"Brandjackers" are also taking advantage of newer avenues like blogs and social media sites to find their victims, while utilizing a broad range of techniques ranging from spam to cybersquatting and phishing. Statistical information confirms indeed a profound increase - 36 percent in one quarter - in the level of phishing attacks as well as in cybersquatting cases, where fraudsters register domains that combine fake financial institutions and brands at the rate of more than one domain per day.

This MarkMonitor report on Brandjacking has been created by tracking millions of emails and billions of web pages, including pages featuring online advertising, eCommerce, auctions and social networking sites analyzed during the September 2008 April 2009 study period.

MarkMonitor, who has kindly granted MasterNewMedia with the permission to republish this unique analysis, is the company who has created the Brandjacking Index, which measures how pervasive brand-based attacks are and how to identify key online threats to strong brands.

Here all the details:

Brandjacking Index - Financial Brand Abuse

by MarkMonitor

In this edition of the Brandjacking Index, we look at brand abuse trends in the financial vertical, focusing on four major financial services brands and four terms associated with the financial crisis - foreclosure, mortgage, refinance and unemployed.

As the economy has worsened over the past months, we found that con artists have exploited consumers’ financial fears and uncertainties, and have rushed in to hijack well-known brands for their own profit.

There has been a profound increase - 36 percent in one quarter - in the level of phishing attacks as well as in cybersquatting.

We identified more than 7,300 questionable domains that were registered using the four financial brand names. Fraudsters registered domains that combined the financial brands that we studied with its four focus terms at the rate of more than one domain per day between September 2008 and the end of our study period in April 2009.

Scams continue to be complex and sophisticated to lure in unsuspecting victims; in fact, cybersquatted domains registered since September 2008 were 50 percent more likely to use the focus terms than domains registered earlier.

MarkMonitor created the Brandjacking Index to measure how pervasive brand-based attacks are and to identify the potential threats to the world’s strongest brands.

As in our previous reports, this edition of the Brandjacking Index tracked millions of emails and billions of web pages, including pages featuring online advertising, eCommerce, auctions and social networking.

Summary Financial Brand Findings

As our economy has worsened, brand abusers have sharpened their focus and created schemes to lure consumers into their trap for mortgage refinancing and phony get-rich-quick investments. Sadly, the only ones who are getting richer are the fraudsters. They are using a variety of simple yet creative techniques to misrepresent themselves.

Here are two examples of websites: the first shows you a phony mortgage refinancing site that exploits paid search listings to bring in traffic and a second site for a spam scam based on another bank brand.

Banking brand abuse site promoted with paid search

Suspicious landing page promoted by spam and taking advantage of a major bank brand

Then there is this page that has so much brand abuse going on, it could be one of those find-the-hidden-picture Sunday supplement puzzles.

The fraudster who created this page exploits trusted TV and newspaper media brands and has the page designed to look like an online newspaper, all with the goal of obtaining personal identity information. To add insult to injury, the page uses encryption technology to give it a greater air of legitimacy!

While many of the suspicious domains that we discovered tried to extract personal information, very few went so far as this site in offering encryption; 52 percent of the domains that we identified did not encrypt any data.

Site exploiting multiple brands, including media and financial brands, takes advantage of “bailouts”

Finally, there are new efforts that make use of social media to lure victims.

Here is "Jessica’s Money Blog" which on the surface looks like thousands of other legitimate blogs that participate in conversations about managing finances or running a small business. But "Jessica" is selling a "home business kit" that promises steep rewards in exchange for a small amount of effort and some personal information, including a credit card number.

Questionable site using social media

These are just a few of the sites that we have discovered that may be exploiting the financial crisis.

A summary of results is shown below for each of the four banking brands studied:

Number of abuses observed by brand and type of abuse

Of the almost 7,400 suspicious domains identified, 16 percent were registered since September 2008 and 17 percent of the total used the focus terms - foreclosure, mortgage, refinance and unemployed - in the site content.

When we examined the more-recently registered domains, the team found evidence of opportunistic abuse.

• Domains registered since September 2008 were 50 percent more likely to use the focus group terms.
• Fraudsters registered domains that combined the financial brands that we studied with our focus terms at the rate of more than one domain per day between September 2008, and the end of our study period in April 2009.

In general, many of the suspicious domains are newly created, as you can see from our analysis of the domain registration dates in the table below:

In terms of geography, 49 percent of the abuse domains were hosted in the United States, while six percent were hosted in the United Kingdom, four percent in Germany, and Australia and Canada tied at three percent each.

Phishing attacks against the financial brands that we studied saw a big jump, with 10,000 attacks in Q1 2009, which was a 36 percent increase compared to Q1 2008.

Phishing attacks on four banking brands by quarter

General Phishing Trends

Interestingly, when we observe phishing trends overall, we found that phish attacks against the payment services category grew more quickly than the financial services category in Q1 2009, with a 40 percent growth from the previous quarter and 285 percent annual growth.

Payment services trend upward while financial services spiked in Q3 2008

Phishers continue to target different industries, shifting their focus from quarter to quarter as the chart below demonstrates. They sharpen their focus using standard direct marketing methods - identifying the most profitable segments and then continuously harvesting new targets within those segments.

Changes in targets for phishing by industry segments

A total of 502 organizations were phished in Q1 2009, which is a 14 percent increase compared to the last quarter of 2008, and a 24 percent annual increase - a large jump from previous observations.

We also saw 93 organizations being new targets in the quarter; the vast majority of them were financial services-related businesses. This could signal that phishers will be redoubling their efforts against this segment going forward.

Number of organizations phished by quarter

We also observed how phishers are adjusting their techniques targeting the retail segment.

• On the left is an older example of a phished retail site, using the oft-used ploy of masquerading as a trusted site, with familiar logos and credentials.
• On the right is a more recent example of a phish against the same brand. In this case, a phony user survey purportedly offered by a trusted retailer promises a $90 credit for its completion, once your credit card number has been given.

Evolving marketing techniques for phishers

And as legitimate sites beef up their defenses, the phishers are following right behind by using similar techniques to make their efforts seem more plausible.

The first example below is a site that uses the ‘captcha’ method of typing a series of numbers to thwart subscription bots, and the second example is a Brazilian site that puts up a warning like a real credit card site.

While both of these sites are aimed at the payment services vertical category, neither is legitimate.

Payment services fraudulent sites

And while the US continues to widen its lead in the hosting of phishing sites, with a ten percent increase from last quarter, Canadian hosted sites have moved up to be the second most popular host country.

Social Media Phish Targets

We continue to see that cybercriminals are targeting new communication platforms like micro-blogging, virtual worlds and social networks.

Phishers are creating phishing sites to collect passwords, conduct identity theft schemes and carry out online advertising scams.

Phish attacks targeting social networks have grown 241 percent from Q1 2008 to Q1 2009 and have grown 1,500-fold since we first started tracking the category in 2007.

Growth of phish attacks against social networks

Phishers have also expanded their reach to web infrastructure sites such as domain registrars and hosting services. Economic reasons for exploiting these sites include redirecting traffic, holding a domain portfolio ransom or hosting further phish scams or pirated content.

Registrars

Hosting

Phishing attacks targeting web infrastructure

Conclusions

Brand abuse is increasing, but more important than the sheer volume is the increased sophistication and the opportunistic nature of brandjackers, who are quick to take advantage of current events and popular concerns.

Brandjackers continue to exploit the confusion over the financial markets that began in the last quarter of 2008 to prey upon vulnerable consumers.

Wielding a wide variety of techniques from more established abuses like spam, cybersquatting and phishing, brandjackers are also taking advantage of newer avenues like blogs and social media sites to find their victims.

Originally written by MarkMonitor for MarkMonitor and first published on March 1st, 2009 as "MarkMonitor Brandjacking Index: Spring 2009".

About the author

MarkMonitor is a company specialized in enterprise brand protection that offers solutions and services that safeguard brands, reputation and revenue from online risks.

The Brandjacking Index is produced by MarkMonitor and explores numerical trends and statistics about online brand abuse. It contains anecdotal information about the business and technical methods used by brandjackers, along with analysis and discussion of the business and social implications of brand abuse.

The cornerstone of the Brandjacking Index is the volume of public data analyzed by MarkMonitor using the company’s proprietary algorithms.

MarkMonitor searches approximately 134 million public domain records, billions of web pages and spam emails and up to 16 million unique suspect phishing emails on a daily basis in order to identify brand abuse. These records come from various public domain data sources, along with Internet feeds from leading international Internet Service Providers (ISPs), email providers and other alliance partners. None of this data contains proprietary customer information.

Photo credits:
Brandjacking Index - Financial Brand Abuse - Robert Mizerek
Summary Financial Brand Findings - pertusinas
General Phishing Trends - Vladimir Popovic
Social Media Phish Targets - mipan edited by Daniele Bazzano

© 2009 MarkMonitor Inc. All rights reserved. MarkMonitor® is a registered trademark of MarkMonitor Inc. All other trademarks included herein are the property of their respective owners.