URL obfuscation misleads the victims into thinking that a link and/or web site displayed in their web browser or HTML-capable email client is that of a trusted site. These methods tend to be technically simple yet highly effective, and are still used to some extent in phishing emails today.

Simple HTML redirection
One of the simplest techniques for obscuring the actual destination of a hyperlink is to use a legitimate URL within an anchor element but have its href attribute point to a malicious site.1 Thus clicking on a legitimate-looking URL actually sends the user to a phishing site. This deception can be detected because web browsers display the actual destination of a hyperlink when a user moves the mouse pointer over the link; this information is typically displayed in the web browser’s status bar.

Use of JPEG images
Electronic mail rendered in HTML format is becoming more prevalent. Phishers are taking advantage of this by constructing phishing emails that contain a single image in JPEG format. When displayed, this image appears to be legitimate email from an online bank or merchant site. The image often includes official logos and text to add to the deception. However, when users click on this image, they are directed to a phishing site. As with the previous example, phishing emails using this technique can often be detected by observing the actual destination URL when mousing over the image.

Use of alternate encoding schemes
Hostnames and IP addresses can be represented in alternate formats that are less likely to be recognizable to most people. Alphanumeric characters can be changed to their hexadecimal representations as follows:

Hexadecimal : %68%74%74%70%3a%2f%2f%77%77%77%2e%65%78%61%6d%70%6c%65%2e%63%6f%6d
ASCII Text : http://www.example.com

Also, IP addresses can be specified as a hexadecimal number:
Dotted Quad Notation : 192.168.1.1
Hexadecimal Format : 0xc0a80101

Web browsers will properly interpret both of these representations. These alternate encoding formats are most often observed in cross-site scripting attacks to obfuscate the malicious URL.

Registration of similar domain names
At initial glance, users may attempt to verify that the address displayed in the address or status bar of their web browser is the one for a legitimate site. Phishers often register domain names that contain the name of their target institution to trick customers who are satisfied by just seeing a legitimate name appear in a URL. An example is hosting a phishing site at http://www.<bankname>-online.biz, where <bankname> would be
replaced by the name of the target bank.

A widely implemented version of this attack uses parts of a legitimate URL to form a new domain  name as demonstrated below:
Legitimate URL : http://login.example.com
Malicious URL : http://login-example.com

“Bots” refer to programs that reside on a computer and provide remote command and control access via a variety of protocols, including IRC, HTTP, instant messaging, and peer-to-peer protocols. When several of these bots are under common control, it is commonly referred to as a botnet. Bots provide the controller with features that can be used to support illicit activity, including :

1. Relays for sending spam and phishing emails
2. Web servers or redirectors for spam/phishing sites or malware distribution
3. Updates for existing malware
4. Installation of additional malware
5. Distributed denial of service (DDoS)
6. Proxy services
7. Pay-for-click services
8. Vulnerability scanning and exploitation
9. Surveillance

In addition to the ability of most bots to infect new hosts through built-in scanning and exploitation of  vulnerabilities, bots can also be deployed through social engineering techniques. These include mass mailing, file-sharing programs, and instant messaging networks.

Originally, phishing was identified as the use of electronic mail messages, designed to look like messages from a trusted agent, such as a bank, auction site, or online commerce site. These messages usually implore the user to take some form of action, such as validating their account information. These messages often use a sense of urgency (such as the threat of account suspension) to motivate the user to take action. Recently, there have been several new social engineering approaches to deceive unsuspecting users. These include the offer to fill out a survey for an online banking site with a monetary reward if the user includes account information, and email messages claiming to be from hotel reward clubs, asking users to verify credit card information that a customer may store on the legitimate site for reservation purposes. Included in the message is a URL for the victim to use, which then directs the user to a site to enter their personal information. This site is crafted to closely mimic the look and feel of the legitimate site. The information is then collected and used by the criminals. Over time, these fake emails and web sites have evolved to become more technically deceiving to casual investigation.

Recently the definition of phishing has grown to encompass a wider variety of electronic financial crimes. In addition to the widespread use of these fake email messages and web sites to lure users into divulging their personal information, we have also observed an increase in the amount of malicious code that specifically targets user account information. Once installed on a victim’s computer, these programs use a variety of techniques to spy on communications with web sites and collect account information. This method differs from the technical subterfuge generally associated with phishing scams and can be included within the definition of spyware as well. It is important to include them in a discussion on phishing trends for the following reasons:

Social component – Criminals often use social engineering along with vulnerabilities in applications such as web browsers or email clients to trick users into installing malicious code on their computer.

Common infrastructure – We have observed the use of common tools and techniques for delivering phishing emails and distributing malware. These include the use of botnets, open mail relays, and compromised web sites to host phishing sites and malware.

The big picture - As countermeasures are implemented to thwart one method of stealing information, criminals still have additional opportunities available to them. It is important to understand the technical capabilities available to these criminals so that more effective measures for protecting customer information can be developed and law enforcement personnel tasked with tracking down and prosecuting criminals conducting phishing scams can be more effective.