TL;DR: 1,470,435,351 sites across 323,147,961 domains and 15,463,120 web-facing computers, while nginx and OpenResty gained share and Google and Apache lost ground, according to Netcraft's September 2026 web server survey. That concentration matters because attacker infrastructure often hides in ordinary hosting layers, so exposure and abuse detection must track platform mix as closely as content risk.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Netcraft's blog post: Web server share is consolidating around nginx and OpenResty, while Google and Apache lost ground in September 2026.
Why it matters: That shift matters because the hosting stack behind phishing, fraud, and scam infrastructure influences exposure, abuse detection, and takedown speed for security and identity teams.
Context
Web server telemetry is a useful proxy for how internet-facing infrastructure is distributed, because hosting choices shape what defenders can discover, monitor, and disrupt. When a few server families gain share quickly, the operational footprint for phishing, fraud, and scam campaigns tends to become more standardised and harder to distinguish from legitimate traffic.
This survey is not about identity governance in the narrow sense, but it does matter to practitioners who track abuse infrastructure and brand impersonation. The question is less which server is popular and more how concentration changes the defender's ability to spot malicious hosting patterns early.
Key questions
Q: How do phishing takedowns use hosting fingerprints?
A: Takedown teams use hosting fingerprints to connect multiple malicious domains to the same operator, even when the content changes. Server family, certificate reuse, redirect paths, and page templates help show pattern continuity, which makes notices more credible and reduces the chance that an operator simply rehosts the same campaign elsewhere.
Q: Why does web server concentration matter for abuse detection?
A: High web server concentration can indicate coordinated abuse because many malicious sites, phishing pages or payload hosts are placed on the same small set of IP ranges, ASNs or providers. Concentrated hosting patterns help defenders cluster related infrastructure, track reuse of certificates and domains, and block at the network, DNS or proxy layer.
Q: How does lookalike domain abuse spread across hosting infrastructure?
A: Lookalike domain abuse often spreads through shared hosting, reseller infrastructure, or cheap cloud instances, where many domains sit behind the same IP space, nameserver set, certificate patterns or redirect chains. The hosting layer can expose shared operators, rapid domain rotation and overlapping control infrastructure used to scale phishing or impersonation.
Q: What should teams look for in scam hosting clusters?
A: Teams should look for shared IP space, repeated ASN use, common certificate reuse, frequent domain rotation, and chained redirects that point to the same landing pages or credential harvesting flows. Redirect behaviour often reveals where scam infrastructure is concentrated, how long it survives, and whether multiple domains are being used as disposable entry points.
Technical breakdown
How web server concentration affects abuse infrastructure
A web server survey measures which server software is visible across active sites and hosts, which gives defenders a rough view of the internet's serving layer. When one or two platforms dominate, attackers can reuse familiar hosting patterns, templates, and operational tooling across many campaigns. That does not make the platforms unsafe by default, but it does mean that abuse detection often has to focus on patterns around hosting, certificates, domains, and redirect chains rather than on the server brand alone.
Practical implication: Treat server mix as an abuse-enablement signal and feed it into phishing and scam infrastructure detection.
Why platform share matters for phishing and scam takedowns
Phishing operations depend on fast deployment, disposable domains, and enough hosting consistency to scale before defenders react. A concentrated web server market can make those operations cheaper and easier to repeat, especially when attackers clone layouts, reuse reverse proxies, or shift between lookalike domains without changing the underlying serving stack. The security problem is not the software itself, but the repeatability it gives to malicious infrastructure. See the Brand Impersonation and Lookalike Domain Takedown Playbook.
Practical implication: Use hosting fingerprints alongside domain and certificate indicators when prioritising takedowns.
What server telemetry does and does not prove
Telemetry from active sites shows presence, not intent. A rise in a server family's share can reflect legitimate migration, managed hosting growth, or CDN usage just as easily as malicious adoption. Practitioners should therefore avoid treating web server market share as a threat indicator on its own. The useful security signal appears when hosting patterns align with suspicious registration behaviour, brand impersonation, or repeated scam landing-page traits. See the Disinformation and Brand Impersonation Guide.
Practical implication: Correlate server telemetry with domain registration, content similarity, and redirect behaviour before escalating abuse cases.
Threat narrative
Attacker objective: The objective is to keep deceptive web infrastructure online long enough to collect credentials, payments, or other high-value victim data at scale.
- Entry occurs when attackers register disposable domains or compromise hosting accounts to stand up phishing or scam pages on ordinary web infrastructure.
- Credential access is often indirect, with stolen brand credentials, certificate material, or panel access used to keep malicious sites online long enough to harvest victims.
- Escalation comes from cloning infrastructure at scale across similar hosting stacks, which makes detection and blocking harder across many near-identical sites.
- Impact is victim credential theft, payment fraud, or brand damage, followed by repeated rehosting after takedown.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
- EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Web server concentration is an abuse-enablement issue, not just a hosting statistic. When a small set of server families carries a large share of visible sites, malicious operators can hide inside ordinary operational patterns and blend with legitimate traffic. That makes infrastructure defence less about naming the server brand and more about correlating hosting behaviour with domain, certificate, and content signals. Practitioners should treat concentration as a factor in abuse resilience, not a verdict on any product.
Brand impersonation gets easier when hosting patterns become predictable. Fraud crews benefit when they can reproduce the same deployment pattern across many domains and landing pages. The operational cost drops, takedown friction rises, and defenders are forced to chase infrastructure variations instead of a single campaign. Lookalike domain takedown remains relevant because the real control problem is speed of evidence, notice, and removal.
Telemetry alone cannot distinguish legitimate migration from malicious reuse. A jump in nginx or OpenResty share may reflect normal infrastructure choices as much as abuse. The governance mistake is to equate prevalence with threat. Security teams need a casework model that joins server fingerprints to impersonation evidence, redirect chains, and victim reporting before they prioritise action.
Phishing infrastructure now behaves like a distributed hosting problem. As server stacks standardise, takedown operations increasingly depend on cross-domain coordination, registrar evidence, and repeatable detection logic. The field needs better operational linkage between content abuse and the infrastructure that serves it, or response will remain reactive and fragmented. Practitioners should build playbooks that assume rapid rehosting is normal.
What this signals
Hosting concentration is becoming a practical intelligence input for fraud defence. As more malicious infrastructure rides on familiar web server patterns, defenders will get better results by linking hosting telemetry to domain age, content similarity, and registrar history. The useful concept here is abuse infrastructure repeatability: when the same serving pattern can be redeployed quickly, the control problem shifts from site-by-site blocking to cluster-based disruption.
Web server mix should be treated as a context signal, not a stand-alone indicator. A rise in nginx or OpenResty share does not by itself prove malicious use, but it can help explain why takedown operations face repeated rehosting and rapid redeployment. Security teams should prepare for abuse cases that move faster than manual review cycles and build workflows that can absorb repeated domain turnover.
For practitioners
- Build hosting-fingerprint triage into abuse detection Add web server family, certificate reuse, and redirect-chain checks to phishing and scam triage so teams can prioritise clusters instead of isolated sites.
- Correlate takedown evidence across related domains Group lookalike domains, cloned pages, and shared hosting markers into one case file before sending registrar or host notices.
- Monitor infrastructure shifts alongside brand abuse reports Watch for sudden changes in the server mix used by suspicious domains, especially when they align with new impersonation campaigns or payment lures.
- Harden victim-facing reporting and escalation paths Make it easier for fraud, trust and safety, and SOC teams to pass suspicious hosting evidence to each other without losing context.
Key takeaways
- Web server distribution is an operational signal for abuse defence because hosting patterns influence how phishing and scam sites are deployed and removed.
- Netcraft's September survey shows a very large active web footprint, with nginx and OpenResty gaining share while Google and Apache declined.
- Security teams should correlate server fingerprints with domain and content signals before prioritising takedown work.
Related NHI Mgmt Group resources: Brand Impersonation and Lookalike Domain Takedown Playbook · Disinformation and Brand Impersonation Guide · Mailchimp breach 2022
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001;TA0010 — Initial Access; Exfiltration | Phishing and scam hosting support the access path and theft outcomes described here. |
| Recommendation — Map hostile hosting clusters to TA0001 and TA0010 patterns when triaging abuse campaigns. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | Active-site telemetry becomes useful when paired with monitoring for suspicious hosting and abuse patterns. |
| Recommendation — Use DE.CM-01 to correlate hosting telemetry with domain and content signals in abuse monitoring. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | Takedown and escalation workflows for phishing infrastructure fit incident response practice. |
| Recommendation — Apply CIS-17 to standardise evidence capture, escalation, and takedown coordination for abuse cases. | ||
Key terms
- Web Server Survey: Web Server Survey is a measurement of web servers across the internet, usually by probing hosts for server response details, headers, TLS settings or exposed services. It is used to map hosting distribution, software versions and infrastructure patterns that help identify clusters of related sites or services.
- Lookalike Domain: A lookalike domain is a web address designed to resemble a trusted brand closely enough to trick users into believing it is legitimate. In identity attacks, the domain becomes part of the deception layer, letting attackers capture credentials, identity details, or payments through a counterfeit flow.
- Host Fingerprinting: Host fingerprinting is the process of identifying a device or system by its observable traits, such as operating system, browser, hardware, network settings, and software behavior. In identity security, these signals help verify device trust, detect impersonation, and support risk-based access decisions across IAM, endpoints, and network controls.
- Phishing Infrastructure: Phishing infrastructure is the collection of technical assets attackers use to run a phishing campaign, including domains, URLs, IP addresses, and hosting resources. These assets often outlive a single email message and can be reused across multiple delivery paths, which is why cross-control enforcement matters.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore it when your programme needs a stronger link between identity controls and the wider security stack.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org