Having trouble reading this email? Read online, Follow us on Twitter & Facebook, or Subscribe via RSS

An extremely convincing phishing attack that impersonates a multi-game skin trade bot appears to be using a fake Extended Validation TLS certificate to steal Steam accounts.

A fake Extended Validation certificate indicator.

The phishing site displaying a fake Extended Validation certificate indicator.

The ongoing phishing attack impersonates TradeIt.gg, which facilitates the trading of skins, weapons and other in-game commodities within popular games like CS:GO, TF2 and DOTA.

When a victim attempts to sign in through Steam to view their inventory on the spoof trading site, Steam's OpenID login form opens in a new window, clearly displaying its use of an Extended Validation certificate issued to Valve Corp...

iframe

... or does it?

Extended Validation (EV) certificates offer the highest level of assurance that a website is being operated by a bona fide legal entity, which is why phishers like to make use of them whenever they can. EV certificates typically cost more than both domain and organisation validated certificates, as the issuance process involves a more stringent vetting process.

However, in this case, the fraudster has bypassed all of the expenses and vetting requirements by simply presenting a fake — yet very convincing — EV certificate indicator next to the address bar.

Closer inspection reveals that the Steam login page is also a spoof form, and it is not actually being displayed in a new browser window at all – it is being shown in an interactive, movable iframe that behaves like a window, allowing the fraudster to dress the "window" up however he likes. The tell-tale feature to look out for here is that the fake window cannot be maximized or moved beyond the boundaries of the spoof trading website.

Needless to say, when a victim submits their Steam credentials into this fake window, they will be stolen by a PHP script on the phishing site. The phisher can then monetize the compromised Steam account by selling it directly or by trading the victim's valuable in-game commodities.

Fraudsters have a long history of exploiting user interface redressing vulnerabilities to make better phishing attacks. More than 14 years ago, Netcraft's anti-phishing toolbar community discovered a particularly fiendish set of examples that exploited a vulnerability in Microsoft Internet Explorer, which allowed part of the webpage to be placed on top of the browser's own address bar.

An extremely convincing PayPal phishing attack that took place back in 2005. A bug in IE made it possible for page elements to be placed outside of the browser's viewport, allowing the attacker to place a fake paypal.com address on top of the browser's real address bar, thus hiding the true location of the fraudulent website.

An extremely convincing PayPal phishing attack that took place back in 2005. A bug in IE made it possible for page elements to be placed outside of the browser's viewport, allowing the attacker to place a fake paypal.com address on top of the browser's real address bar, thus hiding the true location of the fraudulent website.

There are often resurgences in these types of attack, but the certificate and address spoofing techniques are usually forced to change as browser security improves and becomes more restrictive. No doubt there will be more attacks like these in the future, as phishing site developers continue to evolve new tricks.

Netcraft has been protecting consumers against phishing attacks for 15 years. You can enjoy the best protection against the latest attacks, including this Steam trading attack, by installing the desktop Netcraft Extension and Netcraft app for Android.

Posted by Paul Mutton on 12th March, 2019 in Security
Rank Performance Graph OS Outage
hh:mm:ss
Failed
Req%
DNS Connect First
byte
Total
1 Rackspace Linux 0:00:00 0.000 0.652 0.009 0.021 0.021
2 Bigstep Linux 0:00:00 0.000 0.227 0.073 0.147 0.147
3 One.com Linux 0:00:00 0.000 0.378 0.088 0.263 0.263
4 GoDaddy.com Inc Linux 0:00:00 0.005 0.417 0.007 0.021 0.022
5 Hyve Managed Hosting Linux 0:00:00 0.005 0.165 0.069 0.139 0.139
6 Pair Networks unknown 0:00:00 0.005 0.334 0.093 0.187 0.187
7 www.choopa.com Linux 0:00:00 0.009 0.263 0.012 0.036 0.036
8 EveryCity SmartOS 0:00:00 0.009 0.226 0.070 0.339 0.339
9 CWCS Managed Hosting Linux 0:00:00 0.009 0.289 0.077 0.155 0.155
10 Webair Linux 0:00:00 0.009 0.325 0.080 0.160 0.161

See full table

Rackspace had the most reliable hosting company site in February 2019, and has now appeared in the top 10 eight times in the past 12 months. Rackspace offers a range of managed dedicated and cloud hosting solutions.

The top three hosting company sites responded to each of Netcraft's requests in February. Bigstep appears in second place, making February the third consecutive month it has appeared in the top three. Bigstep offers "bare metal" cloud hosting with the flexibility of virtual machines while also providing the isolation and efficiency of bare metal. One.com returns to the top 10 for the first time since October 2018. One.com offers a variety of internet services including a no-code website builder, 1-click WordPress installations, domain registrations and email hosting.

The next sites, placed fourth to sixth, failed to respond to one request from Netcraft. In fourth place is GoDaddy with the fastest average connection speed of 7ms. Hyve Managed Solutions appears in the top 10 for the fourth consecutive month, this time in fifth place. Pair Networks came sixth, with an average connection time of 93ms. The next four sites that made up the top 10 failed to respond to two requests from Netcraft in February 2019.

This month Linux is used by eight of the top 10, remaining the most popular choice. SmartOS makes an appearance in eighth place with EveryCity.

Netcraft measures and makes available the response times of around twenty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

Posted by Netcraft on 6th March, 2019 in Hosting, Performance

In the February 2019 survey we received responses from 1,477,803,927 sites, 229,586,773 unique domains, and 8,366,753 web-facing computers. This reflects a loss of 40.4 million sites, and gains of 979k domains, and 157k web-facing computers.

Microsoft experienced the largest gain in domains this month, with a net increase of just over one million. Despite several months of relatively small fluctuating gains and losses, the number of domains running Microsoft server software is on a general upward trend. Its total now stands at 59.3 million domains, up by just under 2.6 million (+4.6%) since this time last year. However, this strong domain growth was not reflected in any other metric this month – Microsoft gained only 478 web-facing computers, made losses both in active sites and within the top million sites, and suffered a sizable loss of 65 million hostnames.

On 20 February, Microsoft published a security advisory regarding a potential denial of service vulnerability in IIS. It can be exploited by sending specially crafted HTTP/2 requests to a Microsoft IIS web server, causing CPU usage to spike to 100% until the malicious connections are killed by IIS. Microsoft has addressed this issue in February's "non-security" update by providing the ability to define limits on the number of HTTP/2 settings parameters allowed over a connection.

nginx's growth in the domains metric was some way behind Microsoft's this month, with an increase of 622k. nginx's current total of 52.6 million domains represents a growth of over 8.6 million domains (+19.1%) since February 2018 – over three times that of Microsoft – however, its market share has remained just under 3 percentage points behind Microsoft's since April 2018. In terms of web-facing computers, nginx experienced the largest increase (+102k), continuing its steady gains in market share. It now holds a 29.0% share of the web-facing computer market with a total of 2.4 million.

The latest version of nginx (1.15.9 mainline) was released on 26 February, with some small changes including two new features and two bug fixes. Another product in the nginx family, NGINX Unit 1.7.1, was also released in February to address a security vulnerability in its router process. NGINX Unit is a lightweight web application server that can serve sandboxed Go, Perl, PHP, Python, Ruby and – soon – Java applications.

Apache is still losing domains, with a decrease of 216k this month, and 7.3 million domains over the past year. Apache is also gradually losing market share in terms of web-facing computers, despite an overall increase in the number of public web servers using it: this month, Apache gained 32.9k web-facing computers, taking its total up to 3.2 million, while competitor growth caused its market share to fall to 38.04%. The latest version, Apache 2.4.38, was released on 22 January. This release in the 2.4.x stable branch is regarded as the best available version of Apache, and includes three security fixes and multiple bug fixes.

Total number of websites

Web server market share

DeveloperJanuary 2019PercentFebruary 2019PercentChange
Microsoft485,175,88531.96%419,972,03928.42%-3.54
Apache323,398,86621.30%386,522,26626.16%4.85
nginx375,594,87524.74%374,544,60625.34%0.61
Google23,982,0331.58%23,912,2501.62%0.04
Web server market share for active sites

DeveloperJanuary 2019PercentFebruary 2019PercentChange
Apache56,252,19730.88%56,114,50330.99%0.11
nginx36,066,10919.80%35,488,48619.60%-0.20
Google14,878,9558.17%14,863,8768.21%0.04
Microsoft11,525,9206.33%11,251,9926.21%-0.11

For more information see Active Sites

Web server market share for top million busiest sites

DeveloperJanuary 2019PercentFebruary 2019PercentChange
Apache328,50732.85%324,73132.47%-0.38
nginx259,10725.91%261,25526.13%0.21
Microsoft91,3629.14%90,2639.03%-0.11
LiteSpeed16,2851.63%16,6991.67%0.04
Web server market share for computers

DeveloperJanuary 2019PercentFebruary 2019PercentChange
Apache3,149,79638.37%3,182,72538.04%-0.33
nginx2,323,62328.30%2,425,60728.99%0.69
Microsoft1,548,72418.86%1,549,20218.52%-0.35
Web server market share for domains

DeveloperJanuary 2019PercentFebruary 2019PercentChange
Apache74,190,74532.45%73,975,13732.22%-0.23
Microsoft58,222,39525.47%59,315,21625.84%0.37
nginx51,932,49722.72%52,554,62322.89%0.17
Google2,094,3830.92%2,120,3280.92%0.01
Posted by Netcraft on 28th February, 2019 in Web Server Survey
Rank Performance Graph OS Outage
hh:mm:ss
Failed
Req%
DNS Connect First
byte
Total
1 www.choopa.com Linux 0:00:00 0.000 0.258 0.012 0.170 0.170
2 EveryCity SmartOS 0:00:00 0.000 0.227 0.070 0.346 0.346
3 Bigstep Linux 0:00:00 0.000 0.225 0.071 0.145 0.145
4 Hyve Managed Hosting Linux 0:00:00 0.000 0.162 0.075 0.150 0.150
5 CWCS Managed Hosting Linux 0:00:00 0.000 0.285 0.081 0.156 0.156
6 www.dinahosting.com Linux 0:00:00 0.004 0.278 0.089 0.178 0.178
7 Pair Networks FreeBSD 0:00:00 0.004 0.335 0.095 0.192 0.192
8 www.viawest.com Linux 0:00:00 0.013 0.430 0.012 0.239 0.240
9 Netcetera Linux 0:00:00 0.017 0.195 0.084 0.167 0.167
10 Swishmail FreeBSD 0:00:00 0.021 0.228 0.086 0.172 0.173

See full table

Choopa.com had the most reliable hosting company website in January 2019, responding to all of Netcraft's requests. The company offers cloud hosting, dedicated servers, colocation and managed services from four locations across the US, Europe and Asia. Choopa.com's primary data centre is located in Piscataway, New Jersey.

EveryCity, Bigstep, Hyve Managed Hosting and CWCS Managed Hosting made up the rest of the top five, with their sites also responding to all of Netcraft's requests last month. The top five sites are separated by their average connection time. EveryCity has appeared in the top 10 hosting company sites over 35 times, maintaining 99.9994% uptime over 4 years. Bigstep has now made six consecutive appearances in the top 10 and maintained 99.97% uptime over 5 years.

Seven of the top ten most reliable hosting company websites used the Linux operating system in January. FreeBSD appears twice in the top ten, with SmartOS also making an appearance.

Netcraft measures and makes available the response times of around twenty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

Posted by Netcraft on 5th February, 2019 in Hosting, Performance

Netcraft's new anti-phishing app, already available in the Google Play store, has just been released to the Amazon Appstore. The iOS app is with Apple for review.

Available at Amazon Appstore Get it on Google Play

Android web browsers lack comprehensive protection against malicious websites, and in most cases only block a small fraction of the sites blocked by their desktop counterparts. The Netcraft app solves this problem by extending our industry-leading phishing protection services to your mobile device. The app equips your Android device with Netcraft's continuously updated feed of phishing websites, and will alert you whenever you visit a site that's included in this blacklist.

The Netcraft app works with the most popular mobile web browsers on Android — including Amazon's Silk browser, Chrome, and Firefox — and other apps, such as Facebook, Twitter, and Slack.

The app's malicious site warning page in Amazon's Silk browser

The app's malicious site warning page in Amazon's Silk browser.

See our original post about the app for more information.

Download the app on Google Play or the Amazon Appstore now to protect yourself from phishing threats on your Android device. Subscribe to our mailing list to be among the first to hear when the Netcraft app for iOS is available, along with other news items from Netcraft.

Posted by Edward Gargan on 31st January, 2019 in Netcraft Services

Subscription Details

To Subscribe: Go to http://www.netcraft.com/about-netcraft/email-subscription/
To Unsubscribe: Go to http://www.netcraft.com/cgi-bin/unsubscription