Would be interesting (though probably not possible) to know the other 2 million. I'm presuming some (most?) of those didn't pass the 3 second rule, but others perhaps just didn't identify tech? Most of the Java web apps I proxy don't have a X-powered-by, so they wouldn't have been counted. There may be an element of 'defaults' for PHP and ASP that are causing them to be slightly overrepresented(?). 93% of sites running either ASP or PHP seems a bit on the high side - I'd have guessed more like 70% between the two.
