The majority (81%) of domain names used for phishing are legitimate domains that have been hacked, according to a new report from the Anti-Phishing Working Group (APWG).
"Phishing most often takes place on compromised Web servers, where the phishers place their phishing pages unbeknownst to the site operators,"" says APWG.
"This method gains the phishers free hosting, and complicates take-down efforts because suspending a domain name or hosting account also disables the resolution of the legitimate user's site. Phishing on a compromised Web site typically takes place on a subdomain or in a subdirectory, where the phish is not easily noticed by the site's operator or visitors."
http://www.securitypronews.com/insiderreports/insider/spn-49-20090528MajorityOfDomainNamesUsedByPhishersAreLegitimate.html
DKD DomainNews