Download websites that use Apache Tomcat

About Apache Tomcat

A Java application server rarely talks to the visitor directly. Apache Tomcat usually sits behind Apache HTTP Server or Nginx, which means a scan of the open web sees the proxy and not the container underneath. Every public count of an application server, including this one, is a floor rather than a total.

What we can see are the deployments that announce themselves, through a server header, a default error page, a recognisable path or a management endpoint left reachable. As of September 2026 the visible set comes to 83,921 sites. We record only 3 distinct version strings, far fewer than the project has shipped, which is itself informative: teams that harden a container strip the banner first, so the versions we can read skew toward installations nobody has locked down. 5.5 appears often enough in that population to be worth noticing, and a container still advertising a release line of that vintage usually belongs to an application nobody has redeployed in years.

Geography behaves oddly for this software. 17,829 of the sites we detect sit in Hong Kong, a concentration that has more to do with hosting supply than with where the applications were written, while .com carries much of the rest. Java applications land on whatever infrastructure the operator rents, and regional providers that image the same stack onto every customer instance produce clusters that look like national preferences but are really one provider's default configuration.

The research value of a hit is that it identifies the stack behind the door. Java on the server implies an enterprise procurement history, an internal development team or a vendor product shipped as a deployable archive, and a maintenance cycle measured in quarters rather than in pushes. Security vendors, application performance vendors and consultancies selling migration work all sell into that profile. So do the people writing vulnerability advisories, who need to know how large the exposed population is before a disclosure lands.

Maintained by Apache Software Foundation and released under Apache 2.0, the container has been in continuous use since 1999, long enough that a single number flattens several distinct populations: current containers running current applications, appliance style products that embed the server invisibly, and abandoned deployments still answering on a forgotten port.

Checking one host tells you whether that host admitted to running the container on one request. The export supports the questions that require the population: how much of the visible install base sits on a release line that is no longer maintained, which countries and suffixes carry it, and which of those domains also expose an administrative path or pair the container with a particular reverse proxy. Because the visible set is a subset of the real one, the honest use of the data is comparative. Movement between snapshots and differences between segments hold up even where the raw total is conservative.