Fraudsters are using a new technique to keep their spoofed Web sites up and running even as authorities pull the plug, a security expert said this week.

According to RSA Security's Naftali Bennett, the senior vice president of its Cyota anti-fraud division, some phishers have started using a tactic called "smart site redirection" to stay a step ahead of the law.

"The goal of the phisher is to keep his spoofed site alive as long as possible," said Bennett. The longer the site remains active, the more victims a phisher can dupe into divulging confidential information such as bank or credit account usernames, passwords, and PINs.

In a smart site redirection, the attacker creates several identical copies of the spoofed site, each with a different URL, often hosted by different ISPs. When the phishing e-mails go out, all include a link to yet another site, a "central redirector." When the potential victim clicks on the e-mailed link, the redirector checks all the phishing sites, identifies which are still live, and invisibly redirects the user to one.

Clever, said Bennett, but just the latest in what he called a "battle of brains" between phishers and security firms.

"This is a new evolution in their tactics to lengthen the duration of the attack," he said.

Phishers first hosted their spoofed site at only one location, but defenders got wise and would track down the site's Internet service provider and convince it to shut down the illegal URL. "The average duration for a phishing site is still 5 or 6 days," said Bennett, although vendors like Cyota, which monitors developing phishing attacks to warn its clients, can trim that to four hours or so.

Next, phishers took to sending out their link-infested spam in several waves, each wave with a pointer to a different spoofed site. Again, said Bennett, their goal was to stretch out the attack time to maximize returns. "They'd send out, say, 20 million e-mails, but divided into five batches several days apart, each sent to a different site so that there would always be at least one site up and running."