  Spam messes up users inbox, consumes resources and spread attacks like DDoS,
MiM, phishing etc. Phishing is a byproduct of email and causes financial loss
to users and loss of reputation to financial institutions. In this paper we
examine the characteristics of phishing and technology used by Phishers. In
order to counter anti-phishing technology, phishers change their mode of
operation; therefore a continuous evaluation of phishing only helps us combat
phisher effectiveness. In our study, we collected seven hundred thousand spam
from a corporate server for a period of 13 months from February 2008 to
February 2009. From the collected data, we identified different kinds of
phishing scams and mode of operation. Our observation shows that phishers are
dynamic and depend more on social engineering techniques rather than software
vulnerabilities. We believe that this study will develop more efficient
anti-phishing methodologies. Based on our analysis, we developed an
anti-phishing methodology and implemented in our network. The results show that
this approach is highly effective to prevent phishing attacks. The proposed
approach reduced more than 80% of the false negatives and more than 95% of
phishing attacks in our network.
