Download websites that use Kooboo CMS

About Kooboo CMS

Kooboo CMS is installed and run by the operator rather than bought as a hosted service, and the toolchain underneath it filters who ends up doing that. The software is written in C#, so a live install usually implies a hosting environment somebody in IT already maintains, a developer or agency comfortable in that ecosystem, and a platform decision taken well away from the marketing team. As of October 2026 we detect Kooboo CMS on 1 site.

The MIT license matters more than the count. Nobody buys a right to run this software, which means Kooboo has no complete record of where it ended up. An agency downloads the source, deploys it for a client, hands over the credentials and moves on. The resulting install base is real, it is in production, and it is invisible to the people who wrote the code. A crawled list of live sites is the only practical way to see it.

Version data shows what that invisibility does over time. Self hosted software drifts: once a site works, upgrading it is a project nobody has budgeted for. The version we record most frequently is 4.4.0.813, though in a spread that wide no single release describes the population, and the tail of older builds is where the operational interest sits.

For anyone doing security work, the spread is the point. Advisories are written against release numbers, and knowing that a CMS exists somewhere in the world tells you nothing actionable. A list of hostnames with a version string beside each one turns an advisory into a checkable set of targets, and it answers that question in one download instead of one lookup per domain.

Commercially the same file reads differently. A .NET install signals an organisation that has already committed to a Microsoft toolchain, which is a useful qualifier if you sell hosting, migration work, .NET development or a competing platform. Kooboo CMS has been available since 2011, long enough that many deployments are now legacy systems maintained by someone other than whoever built them, which is exactly the profile a migration pitch is aimed at.

Two caveats belong on this figure. We record a technology when a page exposes evidence of it, so an install that strips generator markup and version headers does not appear in our count at all. Detection is inferential, and the site total should be read as a floor rather than a census. Second, a version stamp is only as honest as the deployment that emits it, and a patched install can still advertise an old string. What the dataset gives you is a starting population with the hostnames attached, which is the part that cannot be reconstructed from a vendor page or a search engine.