In the July 2024 survey we received responses from 1,104,170,084 sites across 270,429,856 domains and 12,891,416 web-facing computers. This reflects an increase of 2.7 million sites, 1.3 million domains, and 25,984 web-facing computers.

Cloudflare experienced the largest gain of 2.7 million sites (+2.18%) this month, and now accounts for 11.3% (0.21pp) of sites seen by Netcraft. OpenResty made the next largest gain of 2.2 million sites (+1.88%).

nginx experienced the largest loss of 6.5 million sites (-2.78%) this month, reducing its market share to 20.7% (-0.65pp). Apache suffered the next largest loss, down by 3.4 million sites (-1.60%).

Vendor news

• Apache 2.4.62 was released on July 17th, containing fixes for two security vulnerabilities.
• freenginx 1.27.2 was released on July 9th, adding support for rate limiting error logs.
• OpenResty versions 1.21.4.4 and 1.25.3.2 were released on July 21st, fixing a security issue in its fork of LuaJIT that could cause severe performance degradation under certain circumstances.
• Cloudflare added a new one-click button for its customers to block AI scrapers and crawlers.

Developer	June 2024	Percent	July 2024	Percent	Change
nginx	235,170,823	21.35%	228,626,175	20.71%	-0.65
Apache	212,402,611	19.28%	208,999,470	18.93%	-0.36
Cloudflare	121,715,882	11.05%	124,366,036	11.26%	0.21
OpenResty	118,852,803	10.79%	121,083,375	10.97%	0.18

Developer	June 2024	Percent	July 2024	Percent	Change
Apache	36,784,011	19.13%	36,313,526	18.73%	-0.40
nginx	34,778,931	18.09%	34,630,677	17.86%	-0.23
Cloudflare	28,457,465	14.80%	29,463,646	15.19%	0.40
Google	19,253,340	10.01%	19,361,526	9.99%	-0.03

For more information see Active Sites.

Developer	June 2024	Percent	July 2024	Percent	Change
Cloudflare	230,996	23.10%	230,344	23.03%	-0.07
nginx	205,005	20.50%	204,303	20.43%	-0.07
Apache	196,945	19.69%	194,581	19.46%	-0.24
Microsoft	45,441	4.54%	45,186	4.52%	-0.03

Developer	June 2024	Percent	July 2024	Percent	Change
nginx	4,983,288	38.73%	5,000,672	38.79%	0.06
Apache	3,179,967	24.72%	3,171,258	24.60%	-0.12
Microsoft	1,162,544	9.04%	1,168,997	9.07%	0.03

…

For the past year, Netcraft researchers have been tracking a threat actor using generative AI to assist in the creation of 17,000+ phishing and lure sites. These sites operate as infrastructure for phishing attacks that target more than 30 major crypto brands, including Coinbase, Crypto.com, Metamask, Trezor, and others.  

These sites form part of a sophisticated, multi-step attack. The attack utilizes lure sites to hook victims, phishing sites to capture details, and a Traffic Distribution System (TDS) used to mask the relationships between attack infrastructure. With advanced deception techniques, like the ability to capture 2-factor authentication codes, this campaign highlights several of the most innovative capabilities of modern multi-channel phishing threats. 

As phishing attacks become more complex than ever, recent advancements in generative AI further enhance these attacks by enabling threat actors to rapidly automate the creation of unique content that convincingly impersonates a wide variety of targets. The use of gen AI is also evident in other forms of cybercrime, such as donation scams and Advance Fee Fraud. 

Interestingly, many of these AI-generated lure sites do not link to a phishing website, which appears deliberate. These are likely not designed for victims but instead suggest an attempt to flood the Web with similar content, making it harder to find the malicious needles in an AI-generated haystack. Without gen-AI, this new deception technique would be impossible for criminals, even criminal groups, to deploy at scale. For those combatting these threats, utilizing AI, ML, and automated techniques to detect and monitor threats is paramount in identifying and disrupting these nefarious techniques at any scale. 

Anatomy of the attack 

The attack starts with the victim visiting an AI-generated lure site. Lure sites hook unsuspecting victims into a scam and encourage them to complete an action, such as visiting another site, …