Phishing Phishing Activity in Hosting Networks (ASNs)
August 1, 2020 - October 31, 2020

To see where phishing sites were being hosted, we collected the IP addresses that phishing domains and phishing URLs were resolving to when phishing activity was detected and added to a threat or block list. We then identified the ASN where the IP prefix containing the IP address of the phish is allocated and this number identifies the hosting network where phishing attacks were reported.

For the August-October 2020 period, we identified

- 136 hosting networks with at least 100 reported phishing attacks,

- 36 hosting networks with at least 500 reported phishing attacks, and

- 18 hosting networks with at least 1000 reported phishing attacks

We measure phishing attacks to show where phishing sites are hosted and to identify the hosting service that has been allocated the IPv4 address space wherein the IP address of the phishing site lies.

A phisher may use one, several, or large numbers of URLs in a single phishing campaign. We apply rules to our phishing reports to de-duplicate URLs and to analyze hostname, URL path composition, target, and abuse report dates for similarities to obtain sets of URLs that we consider to be involved in one phishing attack. We also apply additional rules to group URLs into attacks based on observed cases.

Table 1 shows the twenty hosting networks with the highest numbers of reported phishing attacks. Several ASNs with small IPv4 address delegations - NAMECHEAP-NET, WEEBLY, AWEX, and BEON-AS-ID PT - had extraordinarily high counts of phishing attacks during this reporting period.