Download websites that use CPG Dragonfly

About CPG Dragonfly

Web software from the era of photo albums, forum signatures and hit counters mostly went to landfill, and the sites built on it went with it. CPG Dragonfly is one of the survivors. The initials in the name still point back at the photo gallery package the system carried as a core module, wrapped in a general content system that gave hobbyist webmasters news posts, articles and user accounts alongside the albums they already had. Running a community site then meant assembling exactly this kind of PHP package by hand.

Dates make the point. Our record puts CPG Dragonfly in service since 2004, written in PHP and released under the GPL v2 license, which places its design decisions before most of what the modern PHP world now takes for granted. Prepared statements everywhere, dependency managers, framework conventions and automatic updates all arrived later. A codebase of that vintage still answering requests has usually not been rewritten to meet them, and in practice the installations that remain are running because nobody has touched them, not because somebody chose them recently.

As of October 2026 we detect CPG Dragonfly on 62 sites. The figure is worth reading as a lower bound. Legacy installations are precisely the ones where a generator tag or a theme path may have been stripped, renamed or lost during a hosting migration, and an abandoned site is also less likely to be reachable at crawl time in the first place. Detection rests on markers left in the delivered HTML, so a hardened or heavily customised install can be running and stay invisible to us.

The reason to want the list is not the software. An unmaintained content system with user accounts and file uploads is a standing security question, and for anyone doing vulnerability research, coordinated disclosure, sector risk assessment or hosting cleanup, the population of domains still running one is the actual research object. A migration vendor reads the same list differently, seeing a set of site owners who will eventually have to move and who have already demonstrated that they will not do it on their own.

A per-domain lookup answers a yes or no question about a site you have already found. Finding them is the hard part, because nothing about a legacy install advertises itself and no vendor keeps a customer list for an open source project that stopped growing long ago. The downloadable dataset hands over the whole detected set at once, with the rest of each domain's stack beside it, so the group can be filtered, sampled, and compared against a later snapshot to see how fast it is disappearing.