Much of the commentary on the SCO distributed denial of service scenario, including our own, has been based on the premise that SCO badly wants to keep their web site running. This may not be the case: unlike Microsoft, which has a real business to run and a real need to keep its web site operational, SCO Executives may not strongly care about the availability of www.sco.com. After all, Michael Doyle’s half a billion dollar patent win against Microsoft scarcely hinged on the response times of the Eolas web site.

In fact, the author of the MyDoom virus has delegated control of the most enormous volume of http traffic that the Internet has yet seen to hostmaster@sco.com. On a whim, SCO can direct that Tsunami at an object of their choosing, simply by changing an A record in named.conf in time for the change to propagate by Sunday.

In this context, SCO Executives may have latitude to consider alternative defenses which do not involve having to parlay with low-down-no-good-Linux-loving-CDN-providers.

Posted by mhp at 30 January 2004 in Dogfood | Print this Page
Further evidence of the financial rewards presently available from phishing is that fraudsters can afford the time and labour of making the attacks by phone rather than being constrained to electronic mail. A mail we received continues the story.

My husband was called on Wednesday by "VISA" and I was called on Thursday by "MasterCard". It worked like this:

Person calling says, "This is Carl Patterson (any name) and I'm calling from the Security and Fraud department at VISA. My Badge number is 12460. Your card has been flagged for an unusual purchase pattern, and I'm calling to verify. This would be on your VISA card. Did you purchase an Anti-Telemarketing Device / any expensive item for £497.99 from a marketing company based in 'Anywhere'?"

Posted by at 30 January 2004 in Security | Print this Page
While Microsoft has a track record of deflecting DDoS attacks, the SCO Group's ability to defend its web site is complicated by the company's legal battle with Linux users. Both companies will be targeted Sunday by denial of service attacks from Windows computers infected by the MyDoom worm.

Content distribution networks (CDN) can play a key role in defeating DDoS attacks, using their large and widely distributed networks of servers to blunt their impact. Microsoft used a CDN service from Akamai to keep its web site online last August, when the Blaster worm programmed machines to launch a DDoS on the Windows Update site. Microsoft's strategy drew considerable attention, as the front page of the www.microsoft.com site was served by Linux machines on Akamai's network.

The largest CDN providers - Akamai, Cable & Wireless and Speedera - all make extensive use of Linux servers. That's a problem for SCO, which contends that Linux includes copyrighted code from its own operating system, and is asking Linux users to pay $699 per server for the right to use its intellectual property. It’s implausible that any of the CDN providers would pay this licence fee. If SCO feels that it is unable to patronise a very prominent Linux user, this eliminates one of the most proven defences and contrasts strongly with Microsoft’s practical and prosaic approach.

Posted by Rich Miller at 29 January 2004 in Performance | Print this Page
Via Net.Works has bought the French hosting company Amen, and is eyeing further acquisitions, the company said today. Via Net.Works, which is based in Amsterdam and has operations in the U.S. and Europe, paid 7 million Euros ($8.7 million) for Amen, one of the fastest-growing hosts in 2003.

Top European Hosting Companies By Hostnames, Dec 03
Hosting Company Dec 03 Country
1&1 Internet AG 3,505,880 Germany
Strato AG 1,918,889 Germany
Host Europe 545,336 United Kingdom
FastHosts 379,553 United Kingdom
UK2.net 342,715 United Kingdom
Deutsche Telekom AG 313,468 Germany
Komplex 309,451 Germany
IP Exchange GmbH 280,407 Germany
Thus 273,965 United Kingdom
Tiscali 229,814 Italy
Via Net.Works/Amen 191,211 Netherlands
EasyNet 190,775 United Kingdom

The merger will more than double Via Net.Works' European hosting customers. Amen hosts 111K hostnames, with growth of 104 percent in 2003, while Via Net.Works hosts about 81K hostnames. The purchase of Paris-based Amen adds a "cash generating pre-paid business model" that will immediately boost the company's earnings.

Posted by Rich Miller at 29 January 2004 in Hosting | Print this Page
A variant of the MyDoom worm will launch a denial of service attack against the Microsoft web site this Sunday, according to Kaspersky Labs.

The variant, dubbed MyDoom.b, is being circulated by computers infected with the original MyDoom, according to Kaspersky. The new version is identical to MyDoom, but includes www.microsoft.com in the targets of its DDoS component, along with www.sco.com. Both attacks are programmed to begin Feb. 1 and continue through Feb. 12.

Posted by Rich Miller at 28 January 2004 in Performance | Print this Page
A forthcoming update to Internet Explorer will disallow the use of the "@" character in URLs, addressing an issue which has helped fraudsters to obscure the true destination in a web site addresses. Once the update is installed, including the @ symbol in urls will return an "invalid syntax error" message. Microsoft's advisory did not say when the update would be available.
Posted by Rich Miller at 28 January 2004 in Security | Print this Page
Over the last six months Debian has been the fastest growing Linux distribution when measured by counting active sites which contain the name of a Linux distribution in the Apache Server header. In percentage terms Debian is closely followed by SuSE and Gentoo. RedHat has a far greater number of sites but a slower growth rate, and actually fell this month, after making widely publicized and controversial changes to its licencing and security update policy. A distribution name is present in a little over a quarter of Linux based Apache sites.

 Distribution   July 2003   January 2004   Growth Rate 
Debian355,469442,75224.6%
SuSE240,411296,21723.2%
Gentoo20,27324,22919.5%
RedHat1,231,9861,451,50517.8%
Mandrake51,29952,5432.4%
Cobalt553,012548,963-0.7%

The trend over the second half of 2003 and to date is as follows:

Posted by at 28 January 2004 in Around the Net | Print this Page
Journalists reporting on SCO and people interested in the www.sco.com site can now subscribe to receive alerts when the site is unavailable.
Posted by Jeremy Prior at 28 January 2004 in Performance | Print this Page
The SCO Group's web site was offline again this evening, as the company issued a statement saying it is experiencing a denial of service attack (DDoS). SCO also offered a $250,000 reward for information leading to the conviction of the author of the fast-spreading MyDoom worm, which is programmed to attack the SCO web site. The source of the outage at sco.com is unclear, as the DDoS component of MyDoom is not triggered until Feb. 1.

SCO performance chart

A dynamically updating graph is available here.

Posted by Rich Miller at 27 January 2004 in Security | Print this Page
Computers infected by the fast-spreading MyDoom e-mail virus will attempt to launch a distributed denial of service attack (DDoS) on the sco.com web site on Feb. 1, according to updated analyses by Symantec and F-Secure. Several hours after the virus began spreading at about 9 p.m. GMT, the SCO web site was offline briefly.

SCO web site performance

A dynamically updating graph is available here.

The virus, also known W32.Novarg.A@mm or WORM_MIMAIL.R, masquerades as a returned e-mail and attempts to disguise an attachment as a text file, similar to ones that often accompany errant e-mails.

Posted by Rich Miller at 27 January 2004 in Security | Print this Page
SAVVIS Communications has outbid six other suitors in a bankruptcy auction for the American web hosting operation of Cable & Wireless. The winning bid by SAVVIS, a managed services provider focused on the financial industry was said to exceed $155 million, topping an exisiting $125 million deal with Gores Technology Group.

Cable & Wireless' money-losing hosting operation remains among the largest in the world, with more than 767K hostnames and 250K active sites. Its 1,000-plus hosting customers include General Electric, Starbucks, Reebok, Office Max, CBS Sportsline and Slashdot.

Posted by Rich Miller at 23 January 2004 in Hosting | Print this Page
After signing up tens of thousands of free accounts, 1&1 Internet has launched its paid services in the U.S., offering shared hosting from $4.99 a month and dedicated servers starting at $49 a month.

1&1, Europe's largest hosting company with more than 3.5 million hostnames, said it had already signed up more than 100,000 accounts through a pre-launch promotion offering free hosting for three years. The offer sought to raise 1&1's profile in America and quickly gain a critical mass of customers.

"1&1 sets new standards on the US Web hosting market with a domain price as low as $5.88 a year and $49 a month for a dedicated server," said Andreas Gauger, chief executive officer for 1&1 Internet.

The domain offer shaves 11 cents off 1&1's previous .com registration price, already the lowest among major hosting providers. At $49 a month, 1&1's dedicated server offering matches the recent launch pricing of Server4You, the American arm of another expansion-minded German host, Intergenia AG. 1&1 also is offering template-driven e-commerce sites for small businesses at monthly rates between $9.99 and $49.99.

In 2003 1&1 Internet AG gained over 800K hostnames, a 30% increase over the year, to become the largest hoster worldwide with over 3.5M hostnames in December 2003. The Netcraft Hosting Provider Switching Analysis showed the US operation to gain over 9K hostnames in December 2003, with largest gains from GoDaddy, EV1Servers and eNom.

Posted by Rich Miller at 22 January 2004 in Hosting | Print this Page
Hosting growth was strong on both sides of the Atlantic in 2003, with European providers keeping pace with American hosts in both percentage growth and hostname growth. Over 17 companies with greater than 50K hostnames in January 2003 had greater than 50% growth, with six of these in Europe.

It was a banner year for hosting companies based in Germany, home to the fastest-growing host and three of the top six in hostname growth. Leading the pace was IP Exchange GmbH, which lived up to its motto ("where the server lives") with 352 percent growth in hostnames on the year.

The top American performers demonstrated that there were successful growth strategies in virtually every market niche, including colocation (Hurricane Electric), dedicated servers (EV1Servers), shared hosting (iPowerWeb), small business e-commerce hosting (Yahoo!) and domain registration and hosting (Go Daddy).

Top Hosting Companies By Percentage Growth, Dec 02 to Dec 03
Hosting Company Dec 02 Dec 03 %
Growth
Growth Primary
Region
IP Exchange GmbH 61,955 280,072 352.06% 218,117 Europe
Hurricane Electric 64,955 194,097 198.82% 129,142 America
iPowerWeb 55,802 165,489 196.56% 109,687 America
GoDaddy Inc 578,838 1,635,676 182.58% 1,056,838 America
EV1Servers.net 218,565 596,372 172.86% 377,807 America
net@ccess 89,810 187,765 109.07% 97,955 America
Agarik/Amen 54,290 110,992 104.44% 56,702 Europe
yahoo.com 277,306 542,687 95.70% 265,381 America
Hostway Corporation 176,580 336,594 90.62% 160,014 Worldwide
BurstNet 50,090 90,869 81.41% 40,779 America
Colt 94,555 169,144 78.88% 74,589 Europe
Domain Factory 65,274 110,946 69.97% 45,672 Europe
Peer1 Networks Inc 98,068 164,354 67.59% 66,286 America
Datapipe 76,334 122,298 60.21% 45,964 America
Proxad 56,912 88,335 55.21% 31,423 Europe
Aruba 112,435 170,065 51.26% 57,630 Europe
Posted by mandy at 21 January 2004 in Hosting | Print this Page
X0 Communications today sought to have lead bidder Gores Technology Group disqualified from an auction for Cable & Wireless' U.S. hosting assets, saying Gores had tampered with XO's efforts to prepare a competing bid, which XO filed late Friday.

In a court filing just hours before the bid deadline, XO said it learned Tuesday that Gores had hired away the XO executive directing a planned joint bid with One Equity Partners, a unit of Bank One Corp. Gores said the motion was "nothing more than thinly-veiled attempt to disrupt the bidding process," and amounted to gamesmanship by XO chairman Carl Icahn.

Posted by Rich Miller at 16 January 2004 in Hosting | Print this Page
Qwest is considering an offer for the U.S. hosting assets of Cable & Wireless, and has asked a bankruptcy court to extend the bidding deadline for three days, from today until Tuesday. Qwest's court filing mentions "a number of other bidders" in addition to Gores Technology Group, which has agreed to buy the U.S. operation for $125 million.

Qwest wants more time to evaluate customer contracts, saying delays in gaining access to documents have left it at a disadvantage to Gores and other suitors. Koch Data Centers LLC made a similar filing, also seeking an extension until Tuesday.

Posted by Rich Miller at 16 January 2004 in Hosting | Print this Page
More than a month after it became widely publicized, a bug in Internet Explorer that allows fraudsters to obscure the true location of urls remains unpatched. A fix for the security gap, which is now being routinely used by phishing scams, was not among the new security updates published Tuesday by Microsoft.
Posted by Rich Miller at 14 January 2004 in Security | Print this Page
1&1 Internet AG is the world's largest hosting company, with 3.5 million hostnames and 1.7 million active sites. On Jan. 22nd, 1&1 will officially launch its US hosting unit, having attracted tens of thousands of users with a pre-launch promotion offering three years of free hosting. 1&1 CEO Andreas Gauger recently shared his thinking on the company's US market entry and the state of the hosting industry. Gauger founded Schlund in 1995, which was bought by 1&1 in 1998.
Posted by Rich Miller at 12 January 2004 in Around the Net, Hosting, Interviews | Print this Page
The second half of 2003, which included the Blaster worm, the SoBig Virus, the power blackout in the Northeast US and Canada, and a spate of distributed denial attacks, was described by Wired magazine as the worst ever for the impact of worms and viruses on internet infrastructure.

In the context of that the performance of the leading hosting company sites monitored by Netcraft seems quite respectable; only three hosting company sites amassed as much as a day’s downtime during the period, while at the other end of the spectrum, five providers went through the entire six month with no outages at all.

From customers’ point of view, the percentage of failed requests is more pertinent than outages on the hosting companies’ own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. Seven hosting companies went through the period with less than 0.01% of requests failing from our five measurement points.

Seven of the top nine sites run on FreeBSD. The exceptions are Datapipe, which is doing a fine job of promoting the reliability of Windows 2003, and German hosting company komplex.net which runs on Linux.

August, the mother of all months, which contained Blaster, Sobig and the North East US power outage, effectively decided several of places in the top 10. Five of the 2003 top 10- AboveNet, Datapipe, iPowerWeb, Yahoo, and Tierranet had no outages at all during August, whereas a thirteen hour power outage put paid to New York Internet, which otherwise sat in the top 10 most of the year.

Four owner managed hosting companies will take considerable pride that Yahoo, with its colossal financial resources and economies of scale, did not come top, with INetU edging out Datapipe, IPowerWeb, and Pair Networks by virtue of an extremely reliable Q4, and faultless December.

Ranking by Failed Requests and Connection Time,
July 1st - December 31st 2003

Hosting Providers 2003

Posted by mhp at 11 January 2004 in Hosting, Performance | Print this Page
Customers of Barclays Bank have received electronic mails that use url encoding and a widely publicised bug in Internet Explorer to obscure the name of the taregt fraud site. The use of url encoding seems to be an innovation for this type of mail, albeit a predictable one.

Viewing the source code of the e-mail link will usually reveal the hoax, showing the target URL is unrelated to the bank. In this case, the e-mail link is encoded with hexadecimal numbers, with each encoded character beginning with "%". Thus, the source code looks like:

http://ibank.barclays.co.uk%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01
%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01
%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01
%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01%01
%01%01%01%01%01%01%01%01%01%01@%77%77%77%2E%6E%65%77%79%65%72
%73%6D%2E%63%6F%6D:%38%30/%31%2C%2C%6C%6F%67%6F%6E%2C%30%30%2E
%70%68%70
The '%01' characters exploit a bug in Microsoft's Internet Explorer web browser which obscures the appearence of the url. The enocded characters makes it tricky for recipients to spot the "@" sign and "://" that give away the concealed URL of the target web page. The real URL is
http://www.newyersm.com:80/1,,logon,00.php
which no longer resolves, but previously was in a netblock owned by Affinity Internet, Inc.

Posted by Rich Miller at 9 January 2004 in Security | Print this Page
While some providers continue to sell domain names at a loss to acquire customers, the industry's larger players are retreating a bit from their price-slashing ways of 2003.

Go Daddy, the current volume leader among registrars, recently returned to $8.95 after briefly lowering its prices to $7.95 in an apparent response to price cuts by EV1Servers and Hostway. Last month EV1Servers hiked its domain pricing from $5 per year to $6.49, which equals the lowest reseller rate available from its wholesale provider, OpenSRS.

But others are willing to sell domains below cost as a marketing strategy. The newest is MyValueHost, a new business unit of HostMysite.com, which has begun selling domain names for $4 a year.

Posted by Rich Miller at 8 January 2004 in Hosting | Print this Page
"Phishing" attacks surged dramatically in the runup to Christmas, with more than 60 million fraudulent email messages sent out over two weeks in mid December, according to data from an industry group.

The Anti-Phishing Working Group identified more than 90 unique email fraud and phishing attacks in November and December, as scammers sought to capitalize on the increased online shopping activity during the holiday season. Numerous campaigns employed a widely publicised bug in Internet Explorer that allows fraudsters to construct more convincing urls.

Posted by Rich Miller at 7 January 2004 in Security | Print this Page
Go Daddy continued its dynamic growth in December, adding 52K hostnames, more than twice as many as the next-best performer, The Planet. The two providers drew from different customer bases, with Go Daddy's gains driven by new domain signups (adding 86K new hostnames while 33K expired) while the The Planet drew business away from other hosting companies. The Planet had a net gain of 14.6K hostnames from competitors, with substantial head-to-head gains against AT&T (6.5K hostnames), EV1Servers (866), BurstNet (540) and NetAccess (460).

Top Hosting Providers By Growth, Nov 03 to Dec 03
Hosting Company Nov 03 Dec 03 Growth %
Growth
Primary
Region
GoDaddy Inc 1,583,263 1,635,680 52,417 3.3% America
The Planet 105,355 124,562 19,207 18.2% America
Ethernext.com 34,611 49,094 14,483 41.8% America
Cable & Wireless 756,403 767,600 11,197 1.5% America
ServInt Corp. 42,907 53,681 10,774 25.1% America
MCI 677,074 686,877 9,803 1.4% America
1&1 Internet AG 3,497,569 3,505,880 8,311 0.2% Europe
Level 3 124,488 132,772 8,284 6.7% America
Datapipe 114,605 122,805 8,200 7.2% America

Posted by Rich Miller at 5 January 2004 in Hosting | Print this Page

Ranking by Failed Requests and Connection time,
December 1st - 31st 2003

hosting_prov_nov2003.png

During December both the INetU and Cable & Wireless sites were faultless with no failed requests at all from any of our five measurement points.

INetU's site has been consistently highly ranked throughout Q4 2003, and has now been in the top three for the last three months running. As neither INetU or Cable and Wireless had any failed requests, INetU is ranked above Cable & Wireless because the average connection time from our performance measurment points to the INetU site was faster.

Cable and Wireless, located in Swindon is the hosting company site that is geographically closest to Netcraft, but it does not enjoy any special advantage because of this; there is only one performance collection point in the UK, which is in London.

Sites running on BSD operating systems occupied four out of the first seven places.

Posted by mhp at 1 January 2004 in Performance | Print this Page

In the January 2004 survey we received responses from 46,067,743 sites.

Graph of market share for top servers across all domains, August 1995 - January 2004

Top Developers
Developer December 2003Percent January 2004Percent Change
Apache3100569067.433104092267.38-0.05
Microsoft959657120.87967597921.000.13
SunONE15303723.3315038553.26-0.07
Zeus7497911.637520531.630.00
Posted by wss at 1 January 2004 in Web Server Survey | Print this Page