An analysis of Google's blacklist of suspected phishing sites found that eBay, PayPal and Bank of America together account for almost two in three (63 per cent) of suspected scam sites.

Security researcher Michael Sutton also discovered that Yahoo! hosts a significant number of bogus websites - as identified by Google's blacklist) - that try to trick surfers into handing over Yahoo! login credentials. Information from the list is used by anti-phishing technology within the Firefox 2 browser and by the Google Toolbar for Firefox.

Sutton found that 83 per cent of sites detailed on the list are no longer available. By their nature, phishing websites have a rapid turnover but Google's blacklist, and other such initiatives, undoubtedly helpCERTs and other net defenders to identify and remove bogus websites more quickly.

Most of the websites contained in the list use social engineering techniques. Spam emails promoting these sites, often posing as security checks from recognised online firms, attempt to trick users into handing over login credentials. Sutton found little evidence of sites that attempt to use software vulnerabilities to swipe passwords from surfers.

This week we received notice via a full disclosure mailing list that Google's blacklists unwittingly contain peoples' user names and passwords. The problem has since been corrected. Google has not responding to our questions about this snafu. So our best guess is that this data was pulled off users' machines by key-logging Trojans, which are known to post their results online so that they might subsequently be harvested by hackers. ®

Related stories

HMRC data debacle used to bait phishing lure (22 February 2008)
Researcher crosses swords with Google over XSS 'flaw' (21 August 2007)
Google's Lemon squeezes out web app bugs (18 July 2007)
eBay resumes Google advertising (25 June 2007)
Google Germany goes kaput (23 January 2007)
Phishers haul in money from Nordic bank (19 January 2007)
Cookie monster menaces Google (18 January 2007)
Dishonest data protection notices could earn jail time (18 January 2007)
1RT Group fined £5,000 for fax spam (11 January 2007)
Mysterious drop in fraud and spam (9 January 2007)
HM Revenue phish surfaces (8 January 2007)
Firefox outshines IE in phish fight (15 November 2006)
eBay redirection ruse reloaded (13 November 2006)
Gmail phishing email offers $500 prize (12 July 2006)
Why phishing catches punters (7 June 2006)
Phishing with Google Desktop (3 December 2005)
Beware of Yahoo! spam scam (1 November 2004)