Download websites that use Jenkins

About Jenkins

Jenkins is an automation server rather than a website technology, and the reason it turns up in a web technology profile at all is that its controller ships a web interface. A build system belongs on an internal network, behind a VPN or an office firewall. When a crawler can fingerprint one from the public internet, someone has published the controller, deliberately or by accident, and the row in our data is a fact about exposure as much as about tooling.

The software is MIT licensed and written in Java, and has been developed under its current name since 2011. Self-hosting is the norm, so each install is a machine a team has to maintain and patch itself. The plugin ecosystem is the reason installs stay in place for years, and also the reason the attack surface is hard to reason about, since the fingerprint identifies the core and says nothing about the plugins loaded beside it.

Version data makes the picture concrete. We record 43 distinct versions across the visible controllers, and the release we see most often is 2.528.2. A spread that wide means the population is not upgrading in step, which is unsurprising for software that publishes a fast-moving line alongside a long-term support line. An exposed controller running an old build is a documented target rather than a theoretical risk, so for attack surface research the version column is the column that matters.

Presence also says something about how a domain is used. A hostname that answers with a build controller is usually not a marketing site but infrastructure that happens to resolve publicly, a continuous integration subdomain, a developer portal, a leftover host from a migration. Grouping those hostnames by their parent organisation maps an engineering estate rather than a public web estate, which is a different picture of a company than its homepage stack gives.

Different buyers read the same rows differently. Security teams and vulnerability researchers want the exposed instances, since a reachable build controller is a path towards source code, deployment credentials and signing keys. Vendors of hosted continuous integration and of software supply chain tooling read the list as demand, because an organisation running its own controller has already accepted the cost of the category and is a shorter sale than one that has automated nothing. Consultancies use it for sizing, on the reasonable assumption that an engineering team of some substance sits behind each install.

As of October 2026 we fingerprint the software on 103 sites, and the number deserves a caveat rather than a headline. Almost every real installation in the world is invisible to a public crawl, sitting on a private address or behind an authentication proxy that returns nothing identifiable. What the list contains is the exposed and the semi-exposed: controllers on public hostnames, instances left behind on staging domains, and login pages that announce the product and its version before authenticating anyone. As a census of use, the count is wrong by orders of magnitude. As a census of what is reachable from outside, which is the question worth asking, the list is the whole point.