Topic starter
11/11/2026 6:00 pm
TL;DR: Web server mix now shapes how quickly phishing and scam infrastructure can spread, hide, and be taken down, as Netcraft's September 2026 web server survey counted 1,470,435,351 sites and 323,147,961 domains, with nginx and OpenResty adding share while Google and Apache declined.
Editorial analysis by NHI Mgmt Group, based on content published by Netcraft: “September 2026 Web Server Survey”.
Key questions
Q: Why does web server concentration matter for abuse detection?
A: High web server concentration can indicate coordinated abuse because many malicious sites, phishing pages or payload hosts are placed on the same small set of IP ranges, ASNs or providers.
Q: How does lookalike domain abuse spread across hosting infrastructure?
A: Lookalike domain abuse often spreads through shared hosting, reseller infrastructure, or cheap cloud instances, where many domains sit behind the same IP space, nameserver set, certificate patterns or redirect chains.
Q: How do phishing takedowns use hosting fingerprints?
A: Takedown teams use hosting fingerprints to connect multiple malicious domains to the same operator, even when the content changes.
Practitioner guidance
- Build hosting-fingerprint triage into abuse detection Add web server family, certificate reuse, and redirect-chain checks to phishing and scam triage so teams can prioritise clusters instead of isolated sites.
- Correlate takedown evidence across related domains Group lookalike domains, cloned pages, and shared hosting markers into one case file before sending registrar or host notices.
- Monitor infrastructure shifts alongside brand abuse reports Watch for sudden changes in the server mix used by suspicious domains, especially when they align with new impersonation campaigns or payment lures.
Bottom line: Web server distribution is an operational signal for abuse defence because hosting patterns influence how phishing and scam sites are deployed and removed.
Glossary terms: Web Server Survey, Lookalike Domain, Host Fingerprinting, Phishing Infrastructure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Web server concentration is an abuse-enablement issue, not just a hosting statistic. When a small set of server families carries a large share of visible sites, malicious operators can hide inside ordinary operational patterns and blend with legitimate traffic. That makes infrastructure defence less about naming the server brand and more about correlating hosting behaviour with domain, certificate, and content signals. Practitioners should treat concentration as a factor in abuse resilience, not a verdict on any product.
A question worth separating out:
Q: What should teams look for in scam hosting clusters?
A: Teams should look for shared IP space, repeated ASN use, common certificate reuse, frequent domain rotation, and chained redirects that point to the same landing pages or credential harvesting flows. Redirect behaviour often reveals where scam infrastructure is concentrated, how long it survives, and whether multiple domains are being used as disposable entry points.
👉 Read our full editorial: Web server market concentration shifts toward nginx and OpenResty