June 2019 Web Server Survey

In the June 2019 survey we received responses from 1,333,421,275 sites across 236,991,999 unique domain names and 8,840,331 web-facing computers. This reflects gains of 6.76 million sites, 1.98 million domains, and 113,000 computers.

nginx has further extended its lead in the hostnames metric, with 52.2 million additional sites pushing its total up to 440 million. Since overtaking Apache in April, nginx has already built up a 4.89 percentage point lead over Apache's market share and is not far off accounting for more than one third of all sites.

Apache retains the lead in all other metrics, but for how long? The proportion of unique domains that are served by Apache has fallen to 30.1%, while nginx snapped up the majority of this month's net domain growth, bringing its share to within 3.4 percentage points of Apache's. There has been a clear trend of Apache's domain market share decreasing, while nginx's increases and looks likely to overtake Apache within a year. A similar trend is evident in web-facing computers and among the top million sites, so it may not be long before nginx steals more of the limelight.

Reports of a remote code execution vulnerability in most recent versions of nginx were downplayed by its developers, who claimed that neither of the two overflow vulnerabilities appeared to be generally exploitable. Both bugs affected the njs scripting language implementation that allows nginx's functionality to be extended; one bug was fixed in njs 0.3.2, which was released on 21 May along with nginx 1.17.0, while the other bug is expected to be fixed in the future release of njs 0.3.3.

Several other product updates were also released during May, including NGINX Unit 1.9.0, lighttpd 1.4.54, LiteSpeed Web Server 5.3.8 (Stable), OpenLiteSpeed 1.5.1, and cPanel & WHM 80. The latest version of cPanel & WHM adds the ability to run Node.js applications, manage API tokens to allow resellers and third-party developers to run API functions, and ensure visitors are redirected to the secure HTTPS versions of sites.

Envoy – the open source edge and service proxy for cloud-native applications, which leapt to prominence in last month's survey – remains in tenth place with around 5 million sites, which are spread across 2.7 million unique domain names.

Cloudflare's web server has moved up into fifth place after gaining more than 5 million websites, giving it a total of 35.1 million sites across 12.9 million domains. The Cloudflare server is used by the edge nodes of Cloudflare's content delivery network, which now serves 2.6% of all sites in this month's survey.

Microsoft saw losses in every metric this month, apart from web-facing computers, where it made a gain of 13,600; however, this was not enough to stop its market share falling slightly, while Apache gained 17,300 computers and nginx gained 64,000.

Developer	May 2019	Percent	June 2019	Percent	Change
nginx	387,416,889	29.20%	439,626,713	32.97%	3.77
Apache	385,685,252	29.07%	374,360,949	28.08%	-1.00
Microsoft	250,440,887	18.88%	205,235,291	15.39%	-3.49
Google	27,711,375	2.09%	28,181,744	2.11%	0.02

Continue reading →

Posted by Netcraft on 17th June, 2019 in Web Server Survey

Most Reliable Hosting Company Sites in May 2019

Rank	Performance Graph	OS	Outage hh:mm:ss	Failed Req%	DNS	Connect	First byte	Total
1	Webair	Linux	0:00:00	0.000	0.341	0.078	0.156	0.157
2	Swishmail	FreeBSD	0:00:00	0.000	0.257	0.090	0.181	0.183
3	Pair Networks	Linux	0:00:00	0.000	0.351	0.092	0.185	0.185
4	One.com	Linux	0:00:00	0.000	0.416	0.094	0.189	0.189
5	www.choopa.com	Linux	0:00:00	0.005	0.287	0.006	0.023	0.024
6	Rackspace	Linux	0:00:00	0.005	0.674	0.007	0.017	0.018
7	Hyve Managed Hosting	Linux	0:00:00	0.005	0.182	0.077	0.153	0.154
8	EveryCity	SmartOS	0:00:00	0.005	0.251	0.077	0.372	0.372
9	Bigstep	Linux	0:00:00	0.005	0.261	0.079	0.161	0.161
10	ServerStack	Linux	0:00:00	0.005	0.253	0.087	0.174	0.174

See full table

Webair had the most reliable hosting company site in May 2019, responding to all of Netcraft's requests, and with an average connection time of 78ms. Webair provides a range of services including managed hosting solutions and high performance cloud environments.

The next three most reliable hosting company sites also responded to all of Netcraft's requests in May 2019 and were separated by average connection time. Swishmail, Pair Networks and One.com were placed second, third and fourth with average connection times of 90ms, 92ms and 94ms. Swishmail is a New York based hosting and email solutions provider.

The remaining six sites that make up the top 10 each failed to respond to one request. Choopa.com appears in fifth with the fastest average connection time among the top 10 of 6ms. Choopa.com has appeared in the top 10 every month so far in 2019, and has had the most reliable hosting company site twice in that period.

Linux continues to be the predominantly used operating system, powering eight of the top ten sites. FreeBSD makes an appearance in second place with Swishmail and SmartOS appears in eighth with EveryCity.

Netcraft measures and makes available the response times of around twenty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

Posted by Netcraft on 4th June, 2019 in Hosting, Performance

CLEOR : la bijouterie en ligne victime d’un skimmer numérique

Read this article in English

La bijouterie en ligne française CLEOR, active dans 136 bijouteries, a été infectée d’un skimmer JavaScript. Le code malveillant injecté est conçu pour envoyer les données bancaires aux criminels sur le formulaire de paiement en ligne légitime de Cleor.

Continue reading →

Posted by Netcraft on 22nd May, 2019 in Security

Fake news is bigger than PayPal

Presently, the most impersonated UK institution is not a bank nor a Government department, but the Daily Mirror, which is used to promote cryptocurrency scams.

The scale of these cryptocurrency scams is substantial, such that there are currently more fake Daily Mirror front pages than PayPal phishing login forms.

An example is an article on how Richard Branson would bring "Financial Freedom for ALL UK Residents".

Fraudsters are impersonating the news websites to deliver cryptocurrency scams

Fraudsters impersonate news websites to deliver cryptocurrency scams.

The general theme of these articles is how readers are able to make a small deposit into a cryptocurrency platform and leverage their algorithms to make easy money. The generally well-worded articles provide step-by-step instructions on how a reader is able to deposit their money and withdraw their supposed profits. The link at the end of these instructions typically takes the victim to a professional-looking site operated by the fraudster where they are directed to deposit their money.

Each article provides step-by-step instructions detailing how deposits can be made

In general, these scams are sophisticated, make use of Geo-blocking, and serve localised content depending on the country of the reader. By visiting these sites from many different locations, we found that numerous news outlets are impersontated. For example, when visiting one of the scams from a German IP address, a German language article is served referencing Der Spiegel and Bild. When visiting from the US and Canada, a diet product scam is served instead of the cryptocurrency scam site. No scams are served when visiting from Russian IP addresses.

The scams serve country-specific content and content targeted at certain demographics

Scams like these have attracted the attention of the UK's Financial Conduct Authority (FCA). In collaboration with Actionfraud, the FCA discovered a rise in the number of fraudulent online trading platforms [1]. The reported number of cryptocurrency and foreign exchange scams more than tripled in the 2018/19 financial year from 530 than 1,834. Many of the reported claims related to cryptocurrency scams.

Posted by Netcraft on 22nd May, 2019 in Around the Net

French jewellery chain Cleor falls victim to skimming attack

Lisez cet article en français

Netcraft recently discovered that French jewellery retailer Cleor—which operates 136 boutiques across France—was infected with a malicious JavaScript skimmer. The injected code sent the fraudster a copy of the credit card details entered by unsuspecting Cleor customers during the legitimate checkout process.

Shopping Site Skimmers

This attack has many of the hallmarks of JavaScript skimming attacks associated with Magecart. Similar to physical card skimmers, credit card credentials are invisibly stolen from unsuspecting customers, in this case through the use of malicious JavaScript code. The stolen credentials are then transmitted to a server (dropsite) under the criminal's control, usually leaving the legitimate transaction unaffected.

In the past few years, this style of attack has affected thousands of websites including those of British Airways and Ticketmaster. As of May 2019, Netcraft is aware of almost 8,000 shopping sites internationally that are currently infected with JavaScript skimming malware. Most of these sites are running common e-commerce software such as Magento, OpenCart and WooCommerce. Attackers target websites running out-of-date versions of these platforms or using plugins with known security flaws.

Skimming for gold

On 10 April 2019, Netcraft discovered that Cleor's website was infected with malicious skimming code.

The malicious code is served from an external domain, cleor.co. This is injected into the website alongside a legitimate Facebook tracking script. The similarity of the domain to the real cleor.com makes it easy to mistake as benign.

A script tag inserted into the website

The skimming code on hxxps://cleor[.]co/api.js has been obfuscated by its author in an attempt to disguise its purpose. This is a common tactic of criminals. When deobfuscated, its malicious intent is made clear:

The malicious code after deobfuscation

The code contains references to credit card input fields, which are used to extract sensitive information entered into the checkout form by visitors to Cleor's site. This data is sent to hxxps://cleor[.]co/track.js, which is also visible in the deobfuscated code.

We confirmed this by doing a test checkout on the site. Once the credit card details were filled in as part of the checkout process, a POST request is sent to hxxps://cleor[.]co/track.js. The data sent to the dropsite is Base64-encoded, decoding it reveals a JSON array containing all of the credentials entered into the form.

Credentials entered into the form are visible in the POST data

Even customers who did not complete their purchase may have been affected, as the credentials are skimmed immediately after they are entered rather than when the checkout form is submitted.

Netcraft alerted Cleor of the incident, and the skimmer injection code has since been removed.

Purpose-Registered Domain

In this attack, a single site, cleor.co, is used to both serve malicious code and receive the stolen credentials. The domain was purpose-registered for this attack, a trait shared with the British Airways skimmer, which makes it easy to mistake the code as benign.

cleor.co was registered with Namecheap on 10 January this year, suggesting the attack may have been carefully planned before deployment or been active for some time.

The criminals responsible for this attack are also plausibly behind at least one other more wide-spread attack from a domain registered just one day later, also with Namecheap, ajaxstatic.com. Both of these attacks are hosted by Ankas-group, the only Moldovan-hosted sources of skimming code identified by Netcraft. ajaxstatic.com is currently hosting at least 27 distinct skimmers which target a range of payment gateways including Authorize.net, Verisign, Stripe and Braintree.

Prevention and protection

A Content-Security-Policy (CSP) header can be used by websites to limit which resources can be loaded by a page by supported browsers. A correctly configured CSP policy can prevent the loading of resources on non-whitelisted domains; in this instance, it could have prevented JavaScript being loaded from cleor.co.

Subresource Integrity (SRI) instructs web browsers to perform integrity checks of third-party resources, which can prevent the browser from loading any resources that have been tampered with. CSP can be used to ensure that all resources loaded on a page use SRI.

In many cases, the proper use of CSP and SRI can protect websites from falling victim to JavaScript attacks; however, it is not a silver bullet. Certain dynamically-loaded scripts are unsuitable for protection by SRI, and if a hacker gains complete control of a server, CSP will often provide no defence. In addition, SRI only provides assurance that a script has not been altered; not that it was safe in the first place.

Netcraft offers a number of services to protect organisations from malicious JavaScript and other forms of attack, including scanning TLDs for malware, web application security testing and enterprise JavaScript protection. For more information on our services, email info@netcraft.com.

Posted by Seth Hayward on 14th May, 2019 in Security

May 2019 Web Server Survey

In the May 2019 survey we received responses from 1,326,664,693 sites across 235,011,143 unique domain names and 8,726,985 web-facing computers. Although this reflects a gain of 1.12 million domains and 113,000 computers, there has been a loss of 119 million sites.

This month's relatively large drop in sites (-8.2%) includes a 10.3 million reduction in the number of websites that are served by nginx, just a month after it became the first vendor other than Microsoft and Apache to serve the largest number of websites over the past 23 years. As Apache lost only 696,000 sites this month, nginx is now only 1.73 million sites ahead, with a market share of 29.20% compared with Apache's 29.07%.

The sites metric has been particularly volatile for Microsoft, which was within two percentage points of Apache's share last month; but this month, it suffered a significant loss of 112 million (-30.8%) sites, leaving it more than 10 points behind with a market share of 18.9%.

Despite losing more than 10 million sites, nginx has outperformed every vendor in all other headline metrics this month – this includes a gain of 939,000 active sites, 1.06 million domains, 63,800 web-facing computers, and an additional 2,120 sites within the top-million websites. Apache continues to lead in all of these metrics, while nginx is in second place and closing, increasing its market share while Apache's declines.

Apache lost 4,330 entries from the top million sites this month, decreasing its share of that market to 31.8%, but leaving it still more than 5 percentage points ahead of nginx. Some of the highest-traffic users of Apache include FedEx, Orange, Slack, Adobe and Ubuntu, while prominent users of nginx include the likes of DuckDuckGo, the BBC, GitLab, and the bit.ly short link service.

The highest-traffic site, www.google.com, uses the in-house gws (Google Web Server), which is also used by many other top-million Google websites, including Google Maps and dozens of country-specific variants of the main search site – like google.de and google.nl.

Envoy

A relatively unfamiliar server called envoy has suddenly leapt into 10th place by sites after experiencing 500-fold growth, increasing its website count from just 10,300 to 5.10 million sites across 2.71 million distinct domains. The majority of these sites are hosted by SquareSpace, which provides easy-to-use website and online store building services that feature drag-and-drop layouts with ready-made templates.

Envoy is an open source edge and service proxy designed for cloud-native applications. It was originally built by the transportation network company Lyft, but Squarespace is now by far the most visible user of the product. Squarespace engineers pursued a self-service infrastructure with Kubernetes to handle the complexity of their software, but to keep up with growth and demand, they started integrating the Envoy proxy into their system more than a year ago to build a service mesh control plane – a policy that turns a set of isolated stateless sidecar proxies into a distributed system.

While this is the first survey in which Envoy has been seen en masse at Squarespace, it is possible that they have already been using it for a number of months without revealing the envoy server header.

cPanel

This month's survey also saw cPanel advance to 9th place with a total of 7.35 million sites. cPanel is a Linux-based web hosting control panel that provides a graphical interface for administering websites via a secure service on port 2083. Most cPanel-administered websites exhibit the bare cPanel server banner on HTTP port 80, but there are also 5.77 million Apache-powered sites that reveal the use of cPanel via Server headers similar to Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4.

While the cPanel interface is aimed at individual end users or hosting customers, the associated WHM (WebHost Manager) interface allows hosting providers to manage large numbers of cPanel user accounts and add custom branding to their customers' dashboards. A slightly cheaper cPanel Solo product also provides most cPanel and WHM features to hosting providers or individuals with only a single server account to manage. These products have led to cPanel being found across a variety of hosting locations in more than 150 countries, ranging from more than 400,000 cPanel-powered sites operated by a single French hosting company, to a single cPanel-powered website in the whole of Zambia.

New web server releases

nginx 1.16.0 was released on 23 April 2019. In keeping with nginx tradition, this first release in the 1.16.x stable branch includes all of the new features and bug fixes that were introduced in the 1.15.x mainline branch – this means it has improved UDP proxying, support for TLS 1.3 early data and dynamic loading of TLS certificates amongst other features.
Envoy 1.10.0 was released on 5 April 2019, enabling TLS 1.3 on the server-side, and making a multitude of other changes and additions. The previous release, 1.9.1, addressed two vulnerabilities – CVE-2019-9900 and CVE-2019-9901– both of which could have allowed remote attackers to bypass access control rules.
GoDaddy is currently using DPS 1.6.0 to serve customer sites that have been created with its Website Builder tool. This server software continues to be updated fairly frequently: the sites were using DPS 1.5.11 when this month's survey data was originally collected, and DPS 1.5.7 during last month's survey.

Developer	April 2019	Percent	May 2019	Percent	Change
nginx	397,728,889	27.52%	387,416,889	29.20%	1.68
Apache	386,380,893	26.73%	385,685,252	29.07%	2.34
Microsoft	362,109,196	25.05%	250,440,887	18.88%	-6.18
Google	25,956,080	1.80%	27,711,375	2.09%	0.29

Continue reading →

Posted by Netcraft on 10th May, 2019 in Web Server Survey

1 2 3 4 5 6 … 221 Next »

Share:

Share:

Share:

Share:

Shopping Site Skimmers

Skimming for gold

Purpose-Registered Domain

Prevention and protection

Share:

Envoy

cPanel

New web server releases

Share:

Advertisers Directory