In the September 2009 survey we received responses from 226,099,841 sites, reflecting a modest rise of 149 thousand sites.

Taking the limelight this month is nginx, which gained 1.2 million sites, beating Apache's growth of 823 thousand. The popular Russian social networking site Vkontakte is the most popular nginx site appearing in Netcraft's million busiest sites. Other popular nginx sites include the comedic Fail Blog and I Can Has Cheezburger? sites, which are both WordPress blogs owned by Pet Holdings, Inc.

lighttpd suffers a significant loss this month, in stark contrast to its impressive growth last month which took its total up to more than two million sites. lighttpd has lost more than half of its sites since last month leaving its new total at 844 thousand. This drop was mainly due to the loss of 1 million sites on the tubely.com domain, which were hosted on the Amazon AWS service.

lighttpd promotes itself as a fast web server suitable for Web 2.0 sites like YouTube, Wikipedia and Meebo, with an event-driven architecture optimised for high performance AJAX applications.

DataPipe and Server Intellect had the most reliable hosting company sites in August 2009.

This is the 4th appearance in the top ten for DataPipe in the last 5 months. The Jersey City based company offers a number of hosting and managed services to a range of vertical industries including the financial services, healthcare and pharmaceutical sectors.

Server Intellect has reached the number one position for the first time this year. They run Windows Server 2008 and are Microsoft Gold Partners, recently achieving Microsoft Security Solutions Competency.

This month sees four company sites using Linux, two using FreeBSD and one using Windows Server 2008.

An ongoing phishing attack against UK taxpayers is being given additional credibility by using a gov.uk domain. Sefton Council is hosting the phishing content on its Novel GroupWise 7.0 site at web11.sefton.gov.uk.

The phish follows one of the typical ploys commonly seen in HMRC and IRS phishing attacks: The victim is led to believe that they can receive a tax refund by submitting their full credit card details, but these details are instead sent directly to the fraudster behind the attack.

The fraudulent form submits the victim's details to a PHP script hosted at www.zamoh.biz.

The UK's Central Office of Information is responsible for deciding who can register gov.uk domains. Eligibility is strictly limited, which helps to preserve the integrity of the gov.uk namespace; however, this obviously has an undesirable effect when this integrity is leveraged by fraudulent content on compromised servers. Netcraft has informed Sefton Council about this phishing attack.

Netcraft provides an Automated Vulnerability Scanning service which regularly tests your internet infrastructure, supplies the information you need to maintain your security and eliminate vulnerabilities, and audits that it has found no serious vulnerabilities using a dynamically generated seal.