i haven't actually looked into the numbers, but zone-h.org has linux website defacements usually in the 50-75% so i guess it just depends on who and how you ask. granted we have yet to see a 'code red' like virus for apache. so far the only virus i recall seeing for apache was for apache+openssl ('slapper'), which at its peak didn't come close to what code red still has.
I just looked at Zone-H, and it seems as though they count each individual domain seperately. On the first page of the most recent defacements, all the Linux defacements happened at something like 4 or 5 IP addresses, where in most cases, the Windows defacements represented distinct machines.
So, if you have 1 ISP, with 500 domains hosted off of one server, and it gets defaced, that is counted as 500 defacements, even though it was only 1 server.
Just food for thought. -Roberto
Description: PGP signature