Exploiting a zero-day vulnerability in MOVEit Transfer, criminals have deployed web shells on vulnerable file transfer servers and gained access to a variety of high-profile organizations. More than a week since remediation instructions were published, Netcraft has discovered web shells still present on servers associated with energy, healthcare, and finance companies. Web shells are control panels used by criminals to exfiltrate data from compromised servers, run exploits, and maintain remote access, often persisting long after the original vulnerability has been fixed. Using zero-day vulnera ..read more

On May 3rd, Google Registry launched eight new top-level domains (TLDs) “for dads, grads and techies”, including a .zip TLD. While these new TLDs come with benefits such as automatic inclusion on the HSTS preload list, the launch of new TLDs has always presented cyber criminals with the opportunity to register domains in bad faith. Parts of the security community, such as the SANS ISC, have already identified the potential for fraud via the potential conflation of a universally known file extension (.zip) with a TLD. TLDs overlapping with file extensions is not a new problem: .com is also an e ..read more

According to a list compiled by E2E and published in partnership with the Independent newspaper, Netcraft is amongst the 100 fastest growing technology companies in the UK. The E2E Tech 100 showcases companies that are excelling, experiencing consistent growth, and creating an impact not just in their own sector, but also on a nationwide or global scale. Netcraft appear in the Tech 100 table, based on independent research and data analysis by Experian. The criterion for inclusion is growth of turnover during 2020 and 2021, and at least £10M at the start of the two-year period. E2E ranked the t ..read more

In the April 2023 survey we received responses from 1,115,422,029 sites across 272,511,659 domains and 12,089,407 web-facing computers. This reflects a gain of 3.2 million domains but a loss of 596,923 sites and 16,775 web-facing computers. nginx experienced large growth for both sites and domains this month. In our April survey, we saw 292.5 million sites running nginx, an increase of 3.0 million since March (+1.04%), and 74.2 million domains, an increase of 1.6 million (+2.23%). It now accounts for 26.23% of sites (+0.28pp) and 27.25% of domains (+0.27pp). LiteSpeed had the largest loss by s ..read more

The hijacking of YouTube accounts to promote bogus cryptocurrency schemes is nothing new. At Netcraft, we’ve previously blogged about the scale of cryptocurrency scams, and we saw attacks on at least 2,000 distinct IP addresses every month in the past year. Cryptocurrency-themed attacks remain popular with cybercriminals, but yesterday we had the opportunity to observe the recent high-profile attack on LinusTechTips as it unfolded. This blog post explains what we saw, and how we protected our users from the scam sites hours before the compromised channels were taken down. All times in this pos ..read more

In the March 2023 survey we received responses from 1,116,018,952 sites across 269,281,081 domains and 12,106,182 web-facing computers. This reflects a loss of 11.6 million sites, 1.4 million domains, and 36,610 web-facing computers. This month, for the first time, nginx overtook Apache within the top million busiest sites. nginx gained 1,447 sites, which increased its market share by 0.14pp to 21.37%, compared to Apache at 21.18% (-0.16pp). This allowed it to regain 2nd place, which it lost when Cloudflare overtook both to claim the top spot in January. nginx was created by Igor Sysoev, with ..read more

The collapse of Silicon Valley Bank (SVB), once the go-to financial institution for early-stage technology businesses and startups, is being exploited by cybercriminals. In this blog post, we discuss some of the tactics and techniques Netcraft has already detected criminals using to exploit SVB’s collapse – either directly or indirectly – as a lure. As the flurry of COVID-themed attacks proved, cybercriminals waste no time in exploiting the attention such stories generate. Criminals often exploit current news stories, or specific times of year (like tax reporting) to make their scam seem more ..read more

In the February 2023 survey we received responses from 1,127,630,293 sites across 270,727,775 unique domains, and 12,142,793 web-facing computers. This reflects a loss of 4,638,508 sites, 240,148 domains and 13,907 computers. OpenResty had the largest percentage growth in sites this month: it is now used by 95,176,082 sites, an increase of 2,884,258 (+3.13%) since last month. This brings its share of sites to 8.44%, up from 8.15% (+0.29pp). OpenResty’s market share by domain count remained stable, with a slight 0.01pp increase this month - its small loss of 14,039 domains was counteracted by t ..read more

In the January 2023 survey we received responses from 1,132,268,801 sites across 270,967,923 unique domains, and 12,156,700 web-facing computers. This reflects a gain of 6,894,269 sites, but a loss of 270,799 domains and 77,725 computers. Within the top million busiest sites, Cloudflare has jumped from 3rd to 1st place — overtaking both Apache and nginx in a single month — its market share increased by 0.56pp and now stands at 21.64%. Along with Apache (21.40%) and nginx (21.20%), the top three web servers power almost two-thirds of the top million busiest sites. Cloudflare’s journey to the to ..read more

In the December 2022 survey we received responses from 1,125,374,532 sites across 271,238,722 domains and 12,234,425 web-facing computers. This reflects a loss of 9.7 million sites, 450,421 domains, and 72,200 web-facing computers. Cloudflare continues its growth, gaining 1.5 million sites (+1.44%) and 309,670 domains (+1.21%). Cloudflare now accounts for 9.14% of sites and 9.57% of domains seen by Netcraft, up by 0.21pp and 0.13pp respectively. Apache lost 7.4 million sites (-3.03%) and 15,439 web-facing computers (-0.46%). However, it saw a modest gain of 52,986 domains (+0.09%). nginx also ..read more