Phishing Activity in Hosting Networks (ASNs)
November 1, 2020 - January 31, 2021

To see where phishing sites were being hosted, we collected the IP addresses that phishing domains and phishing URLs were resolving to when phishing activity was detected and added to a threat or block list. We then identified the ASN where the IP prefix containing the IP address of the phish is allocated and this number identifies the hosting network where phishing attacks were reported.

For the November 1, 2020 to January 31, 2021 period, we identified

- 135 hosting networks with 100 or more reported phishing attacks.

- 41 hosting networks with 500 or more reported phishing attacks. and

- 20 hosting networks with 1000 or more reported phishing attacks.

We measure phishing attacks to show where phishing sites are hosted and to identify the hosting service that has been allocated the IPv4 address space wherein the IP address of the phishing site lies.

A phisher may use one, several, or large numbers of URLs in a single phishing campaign. We apply rules to our phishing reports to de-duplicate URLs and to analyze hostname, URL path composition, target, and abuse report dates for similarities to obtain sets of URLs that we consider to be involved in one phishing attack. We also apply additional rules to group URLs into attacks based on observed cases.

Table 1 shows the twenty hosting networks with the highest numbers of reported phishing attacks. Several ASNs with small IPv4 address delegations - NAMECHEAP-NET, WEEBLY, and AWEX - had extraordinarily high counts of phishing attacks during this reporting period.