The Sophos Security Threat Report found that half of all infected webpages were hosted on Apache servers. The majority of those infected pages were found on legitimate sites.

A Sophos spokesman said:

"With a whopping 80% of all infected webpages found on legitimate sites, it begs the question as to why web hosts are not taking the necessary steps to properly secure their servers.

"Simple measures such as keeping up to date with security patches will go a long way towards thwarting this problem - the fewer holes in server setups, the lower the risk of infection. Web hosts that are currently not behaving responsibly must bite the bullet and take better care of their sites."