See full table

For the second time this year, New York Internet was found to be the most reliable hosting company website. Its data centre is situated at the intersect of two separate power grids and has high-bandwidth connectivity partners AboveNet, Verizon Business, Optimum Lightpath, and AT&T to offer full redundancy and added capacity. The company recently opened a 40,000 square foot facility in Bridgewater, New Jersey.

Last month's most reliable hoster, INetU, is now second on our table - failing to respond to only 3 of our requests.

For a second consecutive month Multacom, who run FreeBSD, are fourth on our table. Multacom was founded in 1997 in Orange County, California and later incorporated under Multacom Corporation with corporate office in Canyon Country, California and Datacenters in downtown Los Angeles.

This month also sees the lowest average failed requests across the top 10 most reliable hosters (at 0.013%) since October 2009 (0.007%). Additionally, Swishmail enters the top 10 this month running FreeBSD; this means that there are now 5 hosting companies running FreeBSD, 4 running Linux and 1 running Windows Server 2003.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage.

Information on the measurement process and current measurements is available.

This month saw four of the major web servers gaining hostnames but only two gaining market share.

Apache saw the largest increase again this month, gaining over 6.7M hostnames and pushing its share of the market above 56%, its highest share in 3 years. This large growth caused Microsoft to lose nearly 1 percentage point of market share despite gaining over 200k hostnames, mostly at China Telecom.

lighttpd has recovered from last month's losses, gaining 600k hostnames. After the massive drop of hostnames at SAVVIS in Australia, they have now partially recovered with the help of 200k new hostnames being served by lighttpd. Additionally iWeb Technologies Inc. have gained 300k hostnames pointing at lighttpd servers.

Google's share has dipped this month, losing 300k hostnames and a similar number of active sites.

This month's results show that three of the six major web servers have gained hostnames in the last month, while the other three suffered losses.

The largest of these gains came from Apache, which saw an increase of over 1.1M hostnames.

Google's share has continued to increase, albeit at a slower rate than last month with just under 500k additional hostnames. This is due to increased activity on Blogger.

lighttpd suffered the largest overall loss this month, falling by 446k hostnames. This was caused by the loss of 690k hostnames at Savvis in Australia. Microsoft also experienced a loss this month, serving 648k fewer hostnames worldwide and also losing 265k active sites. A big contributor to this was a loss of 388k hostnames due to lower activity on Microsoft Live Spaces.

For more information on active servers, see Active Sites

The rogue Mozilla Sniffer add-on was included in the Web Application Security Penetration Testing collection. This set of tools is popular within the security community, as it simplifies the process of discovering vulnerabilities in web applications.

However, using the Mozilla Sniffer add-on would have introduced an unexpected vulnerability in any application being tested — whenever a login form was submitted, the add-on secretly sent a copy of the URL, password and other details to an IP address presumably controlled by the malicious author.

The backdoor was fortunately discovered by Mozilla user Johann-Peter Hartmann of SektionEins while he was using the Mozilla Sniffer add-on to test the security of a friend's online game.

Hartmann told Netcraft:

"I was giving the OWASP Firefox Security Collection a try, installed a bundle of extensions unknown to me and started to have a look at a friend's online game from a security point of view. I started Burp Suite Pro in parallel to check what additional help I can get from the extensions, and to watch what they are doing."

When Hartmann logged into his friend's game, he noticed an unusual HTTP request being made to an unrelated address at http://74.220.219.77. This request transmitted his username and password to the remote server, as well as the URL of the login page.

Hartmann assumed that this nefarious behaviour was caused by one of the new add-ons he had just installed, so he set about extracting the source code from the add-ons and searched for the hidden URL. He was surprised to find the backdoor code in a popular security testing add-on called Tamper Data, although this was because the real rogue add-on — Mozilla Sniffer — was sharing the same UUID as the Tamper Data add-on, which meant it had overwritten the contents of the well-trusted Tamper Data directory. Hartmann said this was a "nice way of hiding backdoor code".

The Mozilla Sniffer add-on overwrote some of the original Tamper Data files, and also added a new script named tamperPost.js. This injects a new search() function, which is called whenever a form is submitted by the browser. This function searches for any forms that have non-empty password fields and then uses two other functions to send the purloined data to the fraudster:

After working out that the Mozilla Sniffer add-on was at fault, Hartmann reported the problem to security@mozilla.org and was impressed by Mozilla's fast and professional response — he received a reply within minutes and the extension was pulled from the site shortly afterwards. Mozilla will be automatically disabling the add-on for anyone who has downloaded and installed it.

Before the add-on was pulled, Hartmann also posted a short review to warn other users:

The fraudster responsible for creating the malicious add-on claims (in poor English) to have been developing Mozilla add-ons since 2009, yet only created an account on the site last month:

Readers of All Things Digital may recognise the photograph as being of deputy managing editor John Paczkowski, who has confirmed to Netcraft that he is not the owner of this Mozilla account and that someone else has used his photo.

Although the Mozilla Sniffer extension was labeled as 'experimental', the malicious author tried to add credence by claiming it had been "validated by MOZILLA validation and reviewed by more than one addon developers" [sic]:

Mozilla subsequently confirmed that they had not reviewed this add-on and are currently working on a new security model that will require all add-ons to be code-reviewed before becoming discoverable on addons.mozilla.org.

Many web applications that undergo security testing are not production ready and may have exposed vast amounts of data and resources to whoever has been harvesting the URLs and passwords stolen by this add-on. Johann-Peter Hartmann told Netcraft that this was the first time he had seen a Firefox add-on being misused as a backdoor, and questioned whether many people check add-ons before using them, particularly when they appear to come from an official source.

See full table

This month INetU is the most reliable hosting company website. It responded to every one of our requests during the month, only the second site to do this so far this year. INetU is a Microsoft Gold Certified Partner and a Red Hat Ready Hosting Partner. It supports Windows Server 2008, Windows Server 2003, and Red Hat Enterprise Linux in both physical servers and virtualized instances on dedicated machines.

Datapipe is a managed hosting and IT services company headquartered in Jersey City, New Jersey. Founded in 1998, the company now maintains eight offices and six data centers in Somerset - NJ, San Jose - CA, the United Kingdom, and China. The company's main site runs FreeBSD and has consitstenly been at the top of our most reliable hosting company sites table, this month ranking second.

Last month's most reliable hosting company, New York Internet now appears in third place.

Netcetera.co.uk, Kattare Internet Services, Memset and Hosting 4 Less have moved into the top 10 this month, which means there are now 5 hosting companies running Linux, 3 running FreeBSD and 1 running Windows.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage.

Information on the measurement process and current measurements is available.

This month's numbers show a mixed picture with two of the five major web servers gaining hostnames in the last month and the other three recording losses.  A similar trend was recorded for active sites.

The largest increase in the number of hostnames served was for Google, which gained 3M due to increased activity at Blogger. The other web server to do better this month than last was Microsoft which served 1.8M more hostnames, 1.2M in the United States.  This was not the result of a single increase, but  significant growth at Microsoft Corp, GoDaddy Inc and VPLS Inc.

nginx was the largest overall loser of hostnames, serving 2.2M fewer than last month. 1.6M of this loss came in China as a result of drops at China Telecom, China Unicom and the Data Communications Bureau of Tianjin Province; the result of stale blogs at sohu.com, blogbus.com and hexun.com being expired from the survey.

Apache served 871k fewer hostnames worldwide and although not the largest overall loser, this figure actually masks much larger changes that occurred in individual countries.  The most significant took place in opposing directions in the United States and the United Kingdom. Apache served 2M more hostnames in the UK this month as a result of colossal growth at Real International Business Co, which saw an increase of more than 1.9M hostnames. However, all of the new hostnames attributed to them in the survey resolve to a single IP address. Meanwhile, in the US, Apache lost 3M hostnames at ThePlanet.com resulting in an overall loss of 2.5M in the country. The vast majority of these expired sites are due to Netcraft expiring stale accounts on the xorg.pl redirection service out of the survey.

For more information on active servers, see Active Sites

On reaching 5,000 validated reports you become eligible for a monthly competition to incentivise large reporters.

To report phishing sites to us, please use the form at http://toolbar.netcraft.com/report_url, or forward any phishing URLs or emails you receive to scam@netcraft.com.

The Netcraft Toolbar, which is available for Firefox, serves as a giant neighbourhood watch scheme for the Internet. Members who encounter a phishing fraud can act to defend the larger community of users against the attack. Once the first recipients of a phishing mail have reported the attack URL, it is blocked for toolbar users who subsequently access the URL and widely disseminated attacks simply mean that the phishing attack will be reported and blocked sooner.

Changes to Netcraft phishing report processing:

Until recently we have rejected reports for URLs which were already blocked by the Netcraft Toolbar. We now accept reports on URLs which are already blocked if the phishing URL targets a different company to any previously accepted reports.

For example, if we receive a report of a phishing URL at http://[example-domain]/directory/paypal targeting PayPal customers and we decide to block all URLs beginning with http://[example-domain]/directory/ a subsequent report of the URL http://[example-domain-here]/directory/HSBC targeting HSBC customers will now be accepted even though access to that URL is already blocked by our Toolbar.

Each accepted report counts towards your incentives. Therefore, when you see a site with multiple phishing URLs targeting multiple companies, please report them all!

Twitter identified the cause of the incident as an "error with networking equipment", which caused the site to run noticeably slowly, sometimes even causing the fail whale to come out for a swim.

A few hours later, an update revealed that the networking problem had not quite gone away, although the site does appear to be fully functional now. Features such as searching, sidebar data and profile image uploads were temporarily disabled last night to try and stabilize the site's performance.

Netcraft's live uptime graphs for twitter.com can be viewed here.

The most reliable hosting company site in May was New York Internet, responding to all but three of Netcraft's requests. It was served by Apache running on FreeBSD.

Established in 1996, New York Internet is located near Wall Street and maintains its own data centers. The company's core services include dedicated servers, colocation and virtual web hosting.

INetU came a close second with just four failed requests.

INetU is an enterprise managed hosting company located in Allentown, PA. They have been in business since 1996 and notably offer a 100% uptime service level guarantee. Managed services provided by INetU include MySQL and MS SQL database clusters, Exchange servers, virtualization and firewalls. Their clients include Fortune 500 companies such as Microsoft, Intel, Northrop Grumman and Canon.

Five of May's top ten most reliable sites used Linux, while three ran on FreeBSD and one on Windows Server 2003.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage.

Information on the measurement process and current measurements is available.

Many sites' location will be unchanged, but some will have moved from one hosting provider to another during the course of the month. Additionally, hosting companies may gain new sites that were not previously in the top million, and lose sites which are no longer present.

The dataset gives a guide to the market share of companies hosting the sites responsible for the great majority of web traffic, and is largely uninfluenced by parked domains, personal sites, shared hosting accounts or the majority of blogs.

Excerpts from March to April 2010

Gains from Not Ranked indicate that a site has entered in to the top million this month. Losses from Not Ranked indicate that the site is no longer in the top million.

Although the top 1000 sites are concentrated amongst the web superpowers, Google, Microsoft, Yahoo and eBay, the hosting locations of the top million sites are widely fragmented, with a little over 3.25% sufficient for top spot.

An advantage of this dataset over the Hosting Provider Switching Analysis is the ability to analyse movement between competing hosting providers on a per-site basis. With this feature, current and previous hosting locations, netblock, operating system and server software for each site is shown.

The dataset is presented in an Excel spreadsheet and provides a variety of different filters and selections. Using the dataset, a hosting company can identify its relative position and closest competitors in each of the top 1,000, 10,000 and 100,000 tiers of site traffic, and also by country, and operating system.

Softlayer Inc – Losses & Gains April 2010

Limitations

• Only sites found by the Web Server Survey will be included. The number of hosts found worldwide running internet web sites by the Web Server Survey is large [over 205 million in April 2010], but is not exhaustive.
• Attributing a site to a hosting company requires that the hoster provides a reverse DNS server for the network. In some cases where no reverse DNS server is configured, the hoster for a site will be shown as unknown.
• Accesses by the Netcraft Toolbar user community are used to determine site traffic rating.

More Information

The dataset is updated each month and is available on a company license basis. Please contact us (sales@netcraft.com) for pricing.