In the past couple of months, Symantec observed phishing sites that spoofed online FIFA games. The legitimate game is played by forming a team of footballers purchased with coins. The more games you win with your team, the more coins you gain. The popular and more skilled footballers demand a higher number of coins.
The phishing campaign was launched with fake offers of free coins to lure online FIFA players. One of the phishing sites was purportedly from a player who sympathized with end users who struggle with the game. The phishing site contained a message from this fictitious player which expressed the embarrassment one goes through for having a team of low profile footballers. The message explained that the site would help players generate free coins so that they could form a more expensive team of footballers. The phishing site prompted users to login with their email address and password to gain up to 10,000 free coins per day. The phishing pages featured popular footballers such as Wayne Rooney, Ronaldinho, Frank Lampard, and Xavi, giving the impression that one could buy these players upon generating the free coins. If end users fell victim to the phishing site, phishers would have successfully stolen their information for identity theft.
The following are some noteworthy statistics observed about of the phishing attack:
· 89% of the phishing sites were hosted on free Web hosting sites.
· 5% used IP domains (for example, domains that look like 255.255.255.255).
· 13% were typosquatting. (Typosquatting refers to the practice of registering domain names that are typo variations of popular Web sites.)
· The country code top level domains (ccTLDs) most utilized was of Tokelau (.tk) and United Kingdom (.uk) with 3% and 0.4% of the phishing attack, respectively.
Internet users are advised to follow best practices to avoid phishing attacks:
• Do not click on suspicious links in email messages.
• Avoid providing any personal information when answering an email.
• Never enter personal information in a pop-up screen.
• Frequently update your security software, such as Norton Internet Security 2011, which protects you from online phishing.