DataPipe, Aplus.net, iWeb, WestHost, Hurricane Electric, Server Intellect, Canada Web Hosting and Tiscali are the most reliable hosting company sites for November 2008. Unusually, there are eight companies sharing the top spot this month, each showing only 1 failed request throughout November.

Of these eight companies, the top two by average connection time (DataPipe and Aplus.net) both use FreeBSD to run their main websites. In November, DataPipe was named among New Jersey's fastest growing companies.

Linux is used by four of November's most reliable hosting companies. This includes Montreal-based iWeb, which has been providing internet hosting infrastructure for 12 years, and WestHost, which has been providing web hosting for 10 years. Linux is also used by Hurricane Electric and Tiscali, both of which have already featured as the most reliable hosting companies earlier this year.

Two of this month's most reliable hosting companies use Windows Server 2003 to power their sites: Server Intellect is a privately owned company located in Florida and offers dedicated servers, shared hosting and virtual servers. Canada Web Hosting also uses Windows Server 2003 for its main site, but offers managed hosting on both Windows and Linux.

The November 2008 survey shows worldwide monthly growth of nearly three million websites, with responses now being received from a total of 185,167,897 sites.

Apache once again tops this month's growth, gaining 1.3 million sites to 93 million, but Microsoft-IIS follows closely gaining 1.1 million extra sites to reach 64 million. Google has grown by 509 thousand this month to approach the 11 million mark.

One interesting change this month is the appearance of 221,000 sites hosted by Yahoo! that now identify themselves as running on the Yahoo! Traffic Server proxy. Last month's survey found only 521 sites that claimed to be running on YTS.

Yahoo! is thought to use YTS to provide reverse proxy and connection management in a number of its services, although many of the company's sites were previously configured to omit the Server header in their HTTP responses. Yahoo! sites thought to use YTS include Bix, delicious, Flickr and Yahoo Groups.

Yahoo! Traffic Server is used to serve 12 billion requests per day. It was originally developed by Inktomi Corporation as a proxy cache for web traffic and streaming media. Websense acquired the technology behind Inktomi's proxy server, modifying it for use in their WebBlazer Web Threat Management System. Inktomi was then acquired by Yahoo! in 2002.

green.ch is the most reliable hosting company site for October 2008. This is the only site that responded to every request made by Netcraft's performance collectors throughout the month.

With more than 70,000 customers, green.ch is one of the leading Swiss internet service providers for small and medium sized businesses. Originally known as agri.ch, the company was formed from a management buyout of the SME and Private Customer division of Cable & Wireless.

green.ch provides broadband internet access and uses its own data centre in Switzerland to focus on providing website hosting, email, SharePoint and VoIP telephony solutions.

green.ch uses Microsoft IIS 6.0 to serve its main site via an F5 BIG-IP device. The company also uses F5 BIG-IP for over 90% of its customers' websites, making green.ch the largest hoster of sites on F5 BIG-IP in Switzerland.

Linux is used by five of October's top ten hosting companies, while two use FreeBSD and Go Daddy uses Windows Server 2003.

In the October 2008 survey we received responses from 182,226,259 sites, which reflects growth of 948 thousand since last month.

Apache once again shows the largest growth, gaining 463 thousand sites this month. ThePlanet.com gains 1.3 million sites this month — nearly all of which are running on Apache — but this includes a large number of 'link farm' sites that use .pl domains to propagate search terms using pornographic phrases.

Google shows the next largest growth and boosts its total by 411 thousand sites. Google now runs 10.5 million sites on its own webserver software, which is used to host its own services in addition to user-generated applications and blogs. Some server names include:

• GFE/1.3, which is used by Google's Blogger service to publish third party blogs under the blogspot.com domain, and spreadsheets and other documents under docs.google.com.
• GWS-GRFE/0.50, which runs Google Groups.
• gws. This simple, lowercase name is used by Google's main search site at google.com and Google Image Search.
• Google Frontend, which is used to run third party applications on Google App Engine (often using the appspot.com domain) and Google Mashups.

Update 2008-10-28: The attack is no longer ongoing. Yahoo has provided us with the following in a statement:

The team was made aware of this particular Cross-Site Scripting issue yesterday morning (Sunday, Oct. 26) and a fix was deployed within a matter of hours. Yahoo! appreciates Netcraft's assistance in identifying this issue.

As a safety precaution, we recommend users change their passwords, should they still be concerned. Users should always verify via their Sign-in Seal that they are giving their passwords to Yahoo.com.

Our original article follows:

The Netcraft toolbar community has detected a vulnerability on a Yahoo website, which (at the time of writing) is currently being used to steal authentication cookies from Yahoo users — transmitting them to a website under the control of a remote attacker. With these stolen details, the attacker can gain access to his victims' Yahoo accounts, such as Yahoo Mail.

The attack exploits a cross-site scripting vulnerability on Yahoo's HotJobs site at hotjobs.yahoo.com, which currently allows the attacker to inject obfuscated JavaScript into the affected page. The script steals the authentication cookies that are sent for the yahoo.com domain and passes them to a different website in the United States, where the attacker is harvesting stolen authentication details.

When websites use cookies to handle authenticated sessions, it is extremely important to protect the cookie values and ensure they are not seen by other parties. Cross-site scripting vulnerabilities often allow these values to be accessed by an attacker and transmitted to a website under their control, which then allows the attacker to use the same cookie values to hijack their victim's session without needing to log in. This type of attack can be mitigated to some extent by using HttpOnly cookies to prevent scripts gaining access to the cookies — a feature that is now supported by most modern browsers.

Earlier this year, Netcraft blocked a similar flaw on another Yahoo website. The previous attack targeted a cross-site scripting vulnerability on Yahoo's ychat.help.yahoo.com site, which was served securely using a valid SSL certificate, adding further credibility to the attack. The attacker used the vulnerability to inject malign JavaScript into one of the site's webpages. Unlike the current attack, the injected code was sourced from a server in Spain, but also resulted in the victim's cookies being stolen and transmitted to a PHP script on the same server.

The small cookie-stealing script injected by the attacker.

A similar technique employed by the current attack.

In both cases, Netcraft found that the Yahoo cookies stolen by the attacker would have allowed him to hijack his victims' browser sessions, letting him gain access to all of their Yahoo Mail emails and any other account which uses cookies for the yahoo.com domain.

Simply visiting the malign URLs on yahoo.com can be enough for a victim to fall prey to the attacker, letting him steal the necessary session cookies to gain access to the victim's email — the victim does not even have to type in their username and password for the attacker to do this. Both attacks send the victim to a blank webpage, leaving them unlikely to realise that their own account has just been compromised.

Both attacks send victims to a innocuous-looking, blank webpage.

The Netcraft Toolbar protects users against both of these attacks, warning that the malformed Yahoo URLs contain cross-site scripting elements, and that the URLs have been classified as known phishing sites.

Netcraft has informed Yahoo of the latest attack, although at the time of writing, the HotJobs vulnerability and the attacker's cookie harvesting script are both still present.

Rackspace and ZeroLag Communications are the most reliable hosting company sites for September 2008. These are the only two sites that responded to every request made by Netcraft's performance collectors throughout the month.

Rackspace specialises in managed hosting and is well known for its promise of Fanatical Support. This is Rackspace's first appearance at the top spot this year, but the company also featured within the top ten for three months in a row between April and June.

ZeroLag Communications states that it uses high-performance technology to deliver hosting solutions for businesses who don't want to wait. The company derives its name from this aspect — the lack of lag, or delay, when users download email or web pages. Besides offering virtual hosting, dedicated servers and colocation, ZeroLag also provides T1 and T3 internet connections, web development services and security consulting. This is also ZeroLag's first appearance at the top spot this year, having made it into the top 10 in both June and July.

Last month's most reliable hosting company site, Hurricane Electric, appears in 7th place this month.

Both Rackspace and ZeroLag Communications run Linux on their main sites. Two other companies within the top ten also use Linux, while green.ch uses F5 BIG IP and pair Networks uses FreeBSD.

American financial services company Citigroup suffered a deluge of phishing attacks after Monday's news that it intended to acquire the banking operations of Wachovia Corporation.

The credit crisis has triggered a number of acquisitions in recent months, and fraudsters have previously tried to exploit such events by orchestrating phishing attacks against the acquiring companies. One motivation for these types of attack is the increased chance of success when potential victims have less familiarity with the genuine website that is being fraudulently mimicked.

However, the timing of this week's attacks may be coincidental — and subsequently Wachovia has announced that it will instead merge with Wells Fargo.

Netcraft offers a countermeasures service to help banks and other financial organizations take down phishing sites. This service complements Netcraft's Phishing, Identity Theft and Bank Fraud Detection service and its free Anti-Phishing Toolbar.

In the September 2008 survey we received responses from 181,277,835 sites. Of the 4.5 million sites that have been gained this month, more than three-quarters are using Apache.

Many of the new Apache sites are hosted at ThePlanet.com, which alone saw growth of 2.6 million sites. As has been the trend for the past few months, hundreds of thousands of the new sites at ThePlanet.com are link farms hosted on Polish (.pl) domain names and contain little more than pornographic text links to other sites within the same domain.

Further down the field, Resin grows significantly this month and is now found powering 343 thousand sites, making Resin the 12th most popular web server in the world. Resin is an application server product from Caucho Technology, which produces high performance open source Java and PHP solutions. Most of the new Resin-powered sites appeared at Panther IT Services, hosted in the Netherlands using .tk domains (Tokelau, a territory of New Zealand). Many of these sites use framesets to display TiKinet text link adverts at the top of the site's content.

SmugMug now contributes more than 18 thousand Apache sites to the Netcraft survey. These sites have the form nickname.smugmug.com and are used by SmugMug customers to display and sell their photographs via SmugMug's secure checkout.

SmugMug demonstrates an interesting mix of technologies, with the sites being hosted using the F5 BIG-IP device, and with more than half a petabyte of data being stored using Amazon S3. SmugMug also makes use of Amazon EC2 to process its customers' high resolution photos and videos. SmugMug has a partnership with Go Daddy to let power users register custom domain names which can be used to point to their galleries.

Hurricane Electric is the most reliable hosting company site for August 2008.

Hurricane Electric is an internet backbone and colocation provider based in Fremont, CA. The company specializes in colocation, dedicated servers, direct internet connections and web hosting using its own network, which uses multiple OC192s, OC48s and gigabit ethernet. Starting off in a garage in 1994, the company now owns serveral datacenters, including a 200,000 square foot facility in Fremont. Hurricane Electric was previously the most reliable hosting company in November 2007

Four of this month's top hosting companies run Linux on their main sites, including Hurricane Electric.