Download websites that use Application Request Routing

About Application Request Routing

Nothing about Application Request Routing is aimed at a website owner. ARR is an extension to Microsoft's IIS that turns a Windows server into a reverse proxy, a load balancer and a cache, and it gets installed by whoever runs the infrastructure, usually a layer above the sites that end up behind it.

The consequence is that a detection here is an estate signal rather than a site signal. Where this proxy sits in front of a domain, the domain belongs to a Windows Server environment: directory services, IIS, most likely ASP.NET applications behind the proxy, an operations team fluent in Microsoft tooling, and a procurement process that already buys from Microsoft under a Proprietary arrangement. One installation can front dozens of hostnames, so the sites we record are the visible surface of a much smaller number of actual deployments and a much smaller number of purchasing decisions.

The version picture is unusually flat. We record 2 distinct versions and 3.0 covers most of what we see, which means the version column is not a useful segmentation axis for this technology the way it is for a fast-moving web server. ARR changes slowly, ships through platform tooling, and gets upgraded on the server's own schedule rather than any application's release cycle.

As of September 2026 the extension is visible on 108,975 sites. United States contributes 41,017 of them and .com leads the domain side, a distribution that follows where Windows server estates sit rather than anything about the sites themselves, because the extension is installed by whoever operates the server rather than chosen by the applications placed behind it.

Detection depends on what the proxy chooses to say about itself. ARR identifies itself in response headers by default, but administrators routinely strip or rewrite those headers, and a CDN in front of the origin erases the evidence entirely. The visible population is therefore biased toward estates that never hardened their headers, which tends to correlate with estates that never hardened much else, and the correlation is itself the reason security vendors want the file. Migration consultancies, cloud vendors selling a move off self-managed Windows infrastructure, application delivery competitors and penetration testers are all after the same thing: not confirmation that one domain runs the proxy, but the full set of organisations still fronting public sites with it, sliced by country, by TLD and by whatever else in the Load balancers data sits alongside it. A single lookup cannot show a pattern across an estate. The download can.