Download websites that use GlassFish

About GlassFish

GlassFish reaching the public internet is usually an accident of history rather than a design decision. A Java application server is meant to sit behind something, and when it answers a request directly it is often because the tier in front of it was retired, the proxy was never configured properly, or the deployment simply outlived the team that built it.

Our record traces stewardship to Eclipse Foundation and the license to CDDL, with 2006 as the first year attached to the technology and Java as the runtime beneath it. The project changed hands over its life, moving from a commercial sponsor into foundation governance, while the deployed code carried on running through every transition. As of October 2026 we see GlassFish on 125 hosts.

Version reporting is the useful part of this particular record. Application servers announce themselves in response headers and error pages, so unlike a framework buried in the application layer, a server tends to say what it is and which build it is running. We hold 13 distinct version strings, and the value that appears most often is 3.1.2. Version strings scattered across that many separate builds are the signature of an estate nobody upgrades on a schedule, where each host reflects the release that was current on the day it was provisioned.

Who wants the list depends on which end they are reading it from. Modernization consultancies and competing Java runtime vendors read it as a market, since every host in the file is an application that somebody eventually has to move, replace or keep alive at growing cost. Security teams read the same rows as exposure, because a server advertising an ageing build on a public address is a lead in itself, whether the researcher works for the organisation or against it. Asset inventory projects use it more prosaically, to find the machines their own documentation forgot to mention.

The count deserves a caveat running in both directions. Any deployment behind a reverse proxy that strips or rewrites the server header is invisible to us, so the real installed base is larger than what we can see, and larger in a way we cannot size. In the other direction a banner is only a claim, and a patched build can keep reporting the version it originally shipped with, so the version column is evidence rather than proof. The reason to take the whole file instead of querying hosts one at a time is that every interesting pattern here is distributional, which builds cluster in which hosting ranges, which countries and domain suffixes carry the long tail, and how quickly the population thins from one release to the next.