Download websites that use RoundCube

About RoundCube

The distribution is the interesting part of this entry. RoundCube sits in our Webmail bucket, which is a rough fit, since the software is a webmail client, a browser interface onto an IMAP mailbox, rather than anything that sends campaigns. What the label does capture is who deploys it. Hosting providers and mail operators install it for their customers, so a detection is almost never a decision made by the owner of the site it appears on.

The geography makes that plain. Of the 5,955 sites where we detect the software as of October 2026, 3,455 resolve to Singapore, a concentration that no genuinely user driven technology produces. Hosting is territorial. A single provider standing up webmail across its customer domains moves a country total on its own, and reading such a figure as national preference would be a mistake.

The domain mix points the same way. The top level domain we record most often is .icu, which is not where established businesses tend to register. Cheaply priced namespaces attract bulk registration, and bulk registration is exactly the customer base that arrives with a control panel and a default webmail install already switched on. Anyone using this population for lead generation should filter hard on registration patterns before contacting a single address.

Development has been carried by the Roundcube Community since 2005, in PHP, distributed under GPL v3 and installed on the same shared servers as the sites it serves. Longevity of that kind has a consequence worth stating plainly: an interface that has been a control panel default for years accumulates installations nobody has looked at since setup, running whatever release the panel shipped at the time.

Detection reads the login page and its assets, which means we find the software only where it answers on a web hostname we crawl. Installations parked on a mail subdomain outside our crawl frontier, or restricted to an internal network, stay invisible to us, and the count should be read as a floor.

Security researchers usually want this population for the reason it exists at scale. An exposed webmail login is an authentication surface, and an inventory of them across a country or top level domain is a different object from a single lookup. Hosting and mail infrastructure vendors want the same list to find providers rather than sites, by grouping detections under shared name servers and address ranges. Doing either job one domain at a time is not possible, which is what the full export is for.