When dealing with online crimes like phishing, spam and malware, it's important to understand where the biggest threats are and what works to defeat them. The latest Global Phishing Survey, published by the Anti-Phishing Working Group (APWG), has new data that shows where phishing has been taking place, and in some cases how and why. The report indicates that, through the later part of 2009, a single gang of phishers – the ‘Avalanche’ operation – was responsible for two-thirds of all phishing attacks launched on the Internet. Greg Aaron, a director at Afilias, analyses the activities of the Avalanche group and asks what they tell us about the state of phishing today. Famous old-time bank robber Willie Sutton said, “Go where the money is … and go there often”. And that's what today's e-criminals are doing – they're going where the money is, and with startling frequency.