Scammers trying to steal consumers' identities create fake websites to simulate actual web pages of banks and well known companies. They create so many pages its almost impossible for search engines to weed them out.
A new study by PandaLabs, a software security firm, estimates hackers are creating 57,000 new Web addresses each week. They position and index these phony sites on leading search engines in the hope that unwary users will click them by mistake.
Those who do will see their computers infected or any data they enter on these pages fall into the hands of criminals. To do this, they use an average of 375 company brands and names of private institutions from all over the world, all of them instantly recognizable. eBay, Western Union and Visa top the rankings of the most frequently used keywords; followed by Amazon, Bank of America, Paypal and the Internal Revenue Service.
As it often happens, a consumer will receive an email that appears to come from a recognizable entity. The message entices the recipient to click on a link that will take him to a web page that, for all appearances, is part of the real company's Web site. But any information entered on the page goes straight to the scammer.
These days, most web savvy consumers know better than to click on links in Spam emails. However, if a fake website shows up in a Google search, that can catch even the most savvy computer user off guard.
Impersonating bank sites
According to the study, some 65 percent of these fake websites are positioned as belonging to banks. For the most part, they pose as banks in order to steal users' login credentials.
Online stores and auction sites are also popular, with eBay the most widely used. Other financial institutions (such as investment funds or stockbrokers) and government organizations occupy the following positions. The latter is largely accounted for by the IRS or other tax-related sites.
Payment platforms, led by Paypal, and ISPs are in fifth and sixth place, while gaming sites -- topped by World of Warcraft -- complete the ranking.
Just as in previous years malware or phishing was typically distributed via email, in 2009 and particularly this year, hackers have opted for BHSEO techniques, which involves creating fake websites using the names of famous brands.
This way, when users search for these names, a link to the malicious website will appear among the first results returned. When they visit these sites, one of two things will happen: either malware will be downloaded onto the user's computer -- with or without their knowledge -- or the website spoofs the appearance of a genuine page, a bank say, and users will unwittingly enter their details which will fall into the hands of criminals.
"The problem is that when you visit a website through search engines, it can be difficult for users to know whether it is genuine or not," said Luis Corrons, Technical Director of PandaLabs. "For this reason, and given the proliferation of this technique, it is advisable to go to banking sites or online stores by typing in the address in the browser, rather than using search engines which, although they are making an effort to mitigate the situation by changing indexing algorithms, cannot fully evade the great avalanche of new Web addresses being created by hackers every day."