THREAT SPOTLIGHT: THE GEOGRAPHY AND NETWORK CHARACTERISTICS OF PHISHING ATTACKS

The country where emails originate and the number of countries they are routed through on the way to their final destination offer important warning signs of phishing attacks.

- Liane Young, Master’s Student at Columbia University

Barracuda recently teamed up with researchers from Columbia University to analyze the geography of phishing emails and how they’re being routed. Examining geolocation and network infrastructure across more than 2 billion emails, including 218,000 phishing emails, sent in the month of January 2020, we found that phishing emails are more likely to originate from certain countries in parts of Eastern Europe, Central America, the Middle East, and Africa, and more likely to be routed through a higher number of locations than emails that are benign.

Researchers also found that a surprisingly large number of attacks originate from large, legitimate cloud providers. This might be because attackers are able to compromise legitimate servers and/or email accounts hosted by these providers.

Here’s a closer look at the impact geography and network infrastructure has on phishing attacks and solutions to help detect, block, and recover from them.

Highlighted Threat

Geolocation and network characteristics of phishing attacks: In phishing attacks, attackers use social engineering tactics to lure victims into providing personal information such as usernames, passwords, credit card numbers, or banking information. Phishing detection largely focuses on the content of phishing emails and the behavior of attackers. As the phishing attacks become more complex, though, those trying to defend against these attacks must use increasingly sophisticated methods.