Indian-Based IT and Education Sites are Targeted the Most for Phishing Attacks

The Internet to hackers is like a vast ocean with a virtually endless supply of potential victims to the proverbial bait of phishing. It just so happens, as revealed in recent studies conducted by Symantec, that the majority of phishing attacks rooting from compromised websites in India were on Information Technology and Education sites.

In the time frame between August 2012 and November 2012, about 3 months in total, Information Technology took to the top of the rankings for being the most targeted type of websites by phishers. As a breakdown statically, Symantec found that 14.4% of all Indian sites attacked for phishing campaigns were Information Technology type sites. Following IT sites, Education sites accounted for 11.9% of all Indian sites attacked followed by product sales and serves at 9.8% and manufacturing at 7.3%. Falling in line behind IT, Educational, product sales and manufacturing sites, was travels and transport type sites accounting for a 5.8% stake in Indian-based sites attacked by phishing hackers.

The chart below (Figure 1) represents a comparison of the types of Indian websites abused for phishing attacks were the longer bars indicates a higher rate of attacks.

Figure 1 - Chart for Indian Websites by industry type abused for phishing attacks

Phishing, a common term used in the IT computer security world, is an act of acquiring passwords, usernames and other personal information from internet users through a site masquerading as a trusted entity. Most often hackers would create their own phishing site to pass it off as a trusted or well-known site to computer users. Now, new-found creativity prevails as hackers take to compromising legitimate websites for the purposes of using them as phishing sites.
Due to the fact that hackers looking to compromise sites for the purpose of setting up new phishing bases, they primarily target vulnerable sites having less security. These sites hardly ever belong to ISPs, government and telecom agencies, which account for the least amount of attacks.

Although the specific results divulged by Symantec spawn out of Indian sites, the takeaway here is that this is a commonality found throughout the internet in certain parts of the world. Hackers will only hijack and exploit sites for phishing if the waters are free of nets, or what we would call secure sites that put forth their best efforts to limit attacks due to vulnerabilities.