Netcraft's Android app now available on the Amazon Appstore
31st January, 2019
Netcraft's new anti-phishing app, already available in the Google Play store, has just been released to the Amazon Appstore. The iOS app is with Apple for review.
Android web browsers lack comprehensive protection against malicious websites, and in most cases only block a small fraction of the sites blocked by their desktop counterparts. The Netcraft app solves this problem by extending our industry-leading phishing protection services to your mobile device. The app equips your Android device with Netcraft's continuously updated feed of phishing websites, and will alert you whenever you visit a site that's included in this blacklist.
The Netcraft app works with the most popular mobile web browsers on Android — including Amazon's Silk browser, Chrome, and Firefox — and other apps, such as Facebook, Twitter, and Slack.
See our original post about the app for more information.
Download the app on Google Play or the Amazon Appstore now to protect yourself from phishing threats on your Android device. Subscribe to our mailing list to be among the first to hear when the Netcraft app for iOS is available, along with other news items from Netcraft.
Posted by Edward Gargan in Netcraft Services
Netcraft releases anti-phishing app for Android
28th January, 2019
Netcraft has developed a new anti-phishing app for Android to defend against fraudulent sites. The Netcraft app is available now on Google Play and at the Amazon Appstore. The Netcraft app for iOS is with Apple for review.
Netcraft's new Android app provides rapid protection against phishing threats, with new attacks blocked as soon as they're determined to be fraudulent by Netcraft. It offers free protection during a one-month trial, after which a monthly or annual subscription can be purchased. You can use the app to report phish to Netcraft without a subscription.
Phishing is not confined to the desktop: in an analysis of a month's worth of log files recovered from phishing sites, Netcraft found that two thirds of visits came from mobile browsers. Some fraudsters also add mobile-specific user interfaces to their phishing attacks, making them even more effective against phone and tablet users.
Despite this, mobile browsers lack comprehensive anti-phishing protection, unlike their desktop counterparts. In a study performed last year, Netcraft found that iOS and Android browsers block only a fraction of the sites that are blocked by their desktop equivalents, leaving mobile users more exposed.
The app makes use of Netcraft's industry-leading anti-phishing feed, which is licensed to the leading web browser vendors, as well as anti-virus, firewall, intrusion detection and content filtering companies. Every day Netcraft processes millions of suspicious URLs to identify phishing attacks. Over 56 million unique phishing sites have been detected and blocked by Netcraft’s community to date.
The Netcraft app works with the most popular mobile web browsers on Android – including Chrome and Firefox – and other apps such as Facebook, Twitter, and Slack. In addition to blocking phish across the web, the app automatically detects phishing URLs in SMS messages, and will alert you to the danger with a notification.
The app allows you to report phishing websites and SMS phishing attacks to Netcraft with just a few taps, protecting other users and making you part of a global safeguarding community.
Download the app on Google Play now to benefit from Netcraft's comprehensive mobile phishing protection on your Android devices. Desktop browser protection is also available in the Netcraft extension for Firefox, Google Chrome, and Opera. Subscribe to our mailing list to be amongst the first to hear when the Netcraft app for iOS is available, along with other news items from Netcraft.
Posted by Paul Mutton in Netcraft Services
January 2019 Web Server Survey
24th January, 2019
In the January 2019 survey we received responses from 1,518,207,412 sites, 228,607,903 unique domains, and 8,209,715 web-facing computers. This reflects a loss of 138 million sites, and gains of 768.9k domains, and 61.9k web-facing computers.
The vast majority of the loss of sites this month was seen for those using Microsoft web server software — dropping by 203 million sites (-29%). While much of this loss was concentrated at a single hosting provider and made up of automatically generated sites, Microsoft suffered losses in all metrics this month, albeit with much smaller reductions elsewhere. While Microsoft lost more than two hundred million sites in a single month, the net loss of domains was just 89k. Much of this drop can be attributed to IIS 6.0 and 7.5, while the latest version 10.0 saw a gain of 89k domains, and IIS 8.5 gained 164k.
nginx continues to gain market share in the web-facing computer metric, with the largest increase of 47k computers this month being more than double that of Apache's 21k gain. In the domains market nginx remains at somewhat of a plateau, with a loss of 144k domains taking its market share down to 22.7% — just 0.2pp higher than its share in April 2018. The largest factor this month — a single domain parking company, Bodis, moving all of its parked sites over to OpenResty. While the survey tracks these two products separately, OpenResty makes uses of the nginx core, integrating it with additional Lua-based modules.
Apache experienced a large gain in the domains metric this month with an increase of 245k. However, even with the losses seen for both Microsoft and nginx, it was not enough to boost Apache's market share which remains at 32.5%. The largest gain in domains came again for Cloudflare with an increase of 500k. Cloudflare predominantly uses its own server software originally based on nginx. OpenResty also saw greater gains than the market leader Apache, increasing by 388k with help from the movement of sites from nginx at Bodis.
Apache has released an update to httpd 2.4.38 to address an "important" remote DoS vulnerability, which allowed remote attackers to trigger an infinite loop through client-initiated renegotiation on servers using httpd 2.4.37 and OpenSSL version 1.1.1 or later. This is the first "important" level security issue in Apache HTTP Server since July 2017.


Developer | December 2018 | Percent | January 2019 | Percent | Change |
---|---|---|---|---|---|
Microsoft | 688,039,056 | 41.53% | 485,175,885 | 31.96% | -9.58 |
nginx | 358,383,169 | 21.63% | 375,594,875 | 24.74% | 3.11 |
Apache | 313,736,739 | 18.94% | 323,398,866 | 21.30% | 2.36 |
23,810,336 | 1.44% | 23,982,033 | 1.58% | 0.14 |
Posted in Web Server Survey
Manufacturing.gov and White House security suffer under U.S. shutdown
16th January, 2019
Dozens more U.S. government websites have become inaccessible since last week, when Netcraft highlighted the impact of security certificates expiring during the federal shutdown.
As of today, more than 130 TLS certificates used by U.S. government websites have expired without being renewed. Some of these sites are now completely inaccessible in modern browsers due to their strict transport security policies.
The latest sites to be affected include some particularly prominent examples.
Take https://manufacturing.gov, for instance. While Trump is keen to highlight the performance of U.S. manufacturing during his administration, the shutdown has meant that nobody was available to renew the site's TLS certificate when it expired on 14 January 2019. Consequently, https://manufacturing.gov is dead in the water, along with https://manufacturingusa.com which shares the same certificate.
Furthermore, as https://manufacturing.gov appears in Chromium's HSTS preload list, visitors are unable to bypass the browser's security warnings, rendering the site unreachable.

A White House subdomain at https://pages.mail.whitehouse.gov has also become unreachable. The certificate used by this site expired on 15 January 2019 and has not been renewed. This site is also covered by an effective preloaded HSTS policy.
Other notable websites to have been affected by expired certificates over the past five days include two FAA (Federal Aviation Authority) websites, a National Archives customer portal, the FFIEC (Federal Financial Institutions Examination Council) Anti-Money Laundering Infobase, several Department of Agriculture sites, and several governmental remote access services.
When the federal government restarts, the White House will need to renew its certificate for pages.mail.whitehouse.gov. The list price for a replacement DigiCert organisation validated certificate — similar to the expired one — could be up to $399 per year, or about 70 Big Macs.
Posted by Paul Mutton in Security
.gov security falters during U.S. shutdown
10th January, 2019
Dozens of U.S. government websites have been rendered either insecure or inaccessible during the ongoing U.S. federal shutdown. These sites include sensitive government payment portals and remote access services, affecting the likes of NASA, the U.S. Department of Justice, and the Court of Appeals.

With around 400,000 federal employees currently furloughed, more than 80 TLS certificates used by .gov websites have so far expired without being renewed. To compound the situation, some of these abandoned websites can no longer be accessed due to strict security measures that were implemented long before the shutdown started.
One such example is https://ows2.usdoj.gov, a U.S. Department of Justice website which uses a certificate that expired in the week leading up the shutdown. The certificate has been signed by a trusted certificate authority, GoDaddy, but it has not been renewed since it expired on 17 December 2018.

In a twist of fate, the usdoj.gov domain — and all of its subdomains — are included in Chromium's HSTS preload list. This is a prudent security measure which forces modern browsers to only use secure, encrypted protocols when accessing the U.S. DoJ websites; however, it will also prevent users from visiting the HTTPS sites when an expired certificate is encountered. In these cases, modern browsers like Google Chrome and Mozilla Firefox deliberately hide the advanced option that would let the user bypass the warning and continue through to the site.
While this behaviour is bound to frustrate some users, in this case, security is arguably better than usability when you can't have both. If users were to ignore such warnings, they would be vulnerable to the type of man-in-the-middle attacks that TLS certificates were intended to combat.
However, only a few of the affected .gov sites implement correctly-functioning HSTS policies. Just a handful of the sites appear in the HSTS preload list, and only a small proportion of the rest attempt to set a policy via the Strict-Transport-Security HTTP header – but the latter policies will not be obeyed when they are served alongside an expired certificate, and so will only be effective if the user has already visited the sites before.
Consequently, most of the affected sites will display an interstitial security warning that the user will be able to bypass. This introduces some realistic security concerns, as task-oriented users are more likely to ignore these security warnings, and will therefore render themselves vulnerable to man-in-the-middle attacks.
For example, https://rockettest.nasa.gov/ is not included in the HSTS preload list, and its certificate expired on 5 January 2019. This causes browsers to display an interstitial security warning that users can ignore.

The following example clearly demonstrates the potential dangers of ignoring browser security warnings. The certificate used by this Berkeley Lab .gov website at https://d2l.lbl.gov expired on 8 January 2019 (although Berkeley Lab was not affected by the shutdown) and has not yet been replaced. As there is no effective HSTS policy, users can ignore the browser's warnings and proceed to the login form.

With Donald Trump seemingly unwilling to compromise on his demands for a wall along the border with Mexico, and Democrats refusing to approve a budget containing $5.7bn for the wall, the hundreds of thousands of unpaid federal employees might not be the only ones hurting. As more and more certificates used by government websites inevitably expire over the following days, weeks — or maybe even months — there could be some realistic opportunities to undermine the security of all U.S. citizens.
Posted by Paul Mutton in Security
Most Reliable Hosting Company Sites in December 2018
3rd January, 2019
Rank | Performance Graph | OS | Outage hh:mm:ss |
Failed Req% |
DNS | Connect | First byte |
Total |
---|---|---|---|---|---|---|---|---|
1 | EveryCity | SmartOS | 0:00:00 | 0.000 | 0.230 | 0.070 | 0.338 | 0.338 |
2 | Bigstep | Linux | 0:00:00 | 0.000 | 0.233 | 0.071 | 0.146 | 0.146 |
3 | Webair | Linux | 0:00:00 | 0.000 | 0.335 | 0.080 | 0.161 | 0.161 |
4 | Hyve Managed Hosting | Linux | 0:00:00 | 0.000 | 0.170 | 0.081 | 0.162 | 0.162 |
5 | CWCS | Linux | 0:00:00 | 0.000 | 0.293 | 0.083 | 0.160 | 0.160 |
6 | Rackspace | Linux | 0:00:00 | 0.004 | 0.663 | 0.006 | 0.015 | 0.015 |
7 | New York Internet (NYI) | FreeBSD | 0:00:00 | 0.004 | 0.540 | 0.063 | 0.125 | 0.125 |
8 | www.dinahosting.com | Linux | 0:00:00 | 0.004 | 0.280 | 0.089 | 0.178 | 0.178 |
9 | krystal.co.uk | Linux | 0:00:00 | 0.004 | 0.241 | 0.100 | 0.198 | 0.198 |
10 | GoDaddy.com Inc | Linux | 0:00:00 | 0.008 | 0.433 | 0.007 | 0.021 | 0.022 |
EveryCity had the most reliable hosting company site in December 2018, with no failed requests and an average connection time of 70ms. EveryCity appeared eight times in the top 10 in 2018, and has maintained 99.9994% uptime over the last four years. The hosting company offers cloud hosting solutions and managed third-party services, with its primary data centre located in the heart of the City of London.
Four other hosting company sites also successfully responded to all of Netcraft's requests, and were ranked by their average connection times. In second place, Bigstep had an average connection time just a millisecond slower than EveryCity. Bigstep has maintained 99.97% uptime over the past five years. Webair, Hyve and CWCS complete the top five, with average connection times of 80ms, 81ms and 83ms.
Linux was the most popular operating system in December 2018, used by eight of the top 10 most reliable hosting company sites. SmartOS is used by EveryCity, which had the most reliable hosting company site. SmartOS is an open-source community fork of OpenSolaris designed specifically for cloud computing. FreeBSD also appears in the top 10 for December.
Netcraft measures and makes available the response times of around twenty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.
From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.
Information on the measurement process and current measurements is available.
Posted in Hosting, Performance
Advertisers Directory
Your link here? Advertising on the Netcraft Blog