Download websites that use SquirrelMail

About SquirrelMail

Not everything we detect was chosen by the person who owns the domain. SquirrelMail is a webmail client, installed on the server so that people can read mail in a browser, and for most of its life it arrived as part of a hosting package rather than as a decision anyone made. Recognizing it on a host says more about the machine and its administrator than about the website sitting in front of it. As of October 2026 we detect SquirrelMail on 171 sites.

The client was released in 1999, written in PHP, and distributed under the GPL v2 license, and its appeal was minimal server requirements and compatibility with almost any mail server. Hosting companies, universities, and departmental servers bundled it by default, which is why it spread far beyond the audience that would have picked it deliberately. Newer webmail interfaces replaced it in most control panels years ago, and yet the installs persist.

Version data makes the persistence measurable. We record 9 distinct versions across the installs we can identify, and the release we see most often is 1.4.23. A spread that wide sitting on top of an old dominant release is the signature of software that stopped moving: nobody is riding an upgrade train, and each install is roughly frozen at whatever the server shipped when it was provisioned. Version, in other words, becomes a rough timestamp for the server rather than for the site.

The implication is the reason anyone buys this slice. A domain in the list is attached to an environment that has not been rebuilt in a long time, running an interface with a long public history of advisories, often alongside other aging components on the same box. Security researchers use populations like this to measure exposure at internet scale. Hosting consolidators use them to find estates ripe for migration. Vendors of modern webmail and mail hosting use them as a straightforward prospect list, since the incumbent is not defending the account.

Two limits belong on the record. Webmail usually lives on a subdomain or a path rather than at the front door, so whether we see it depends on what is reachable at the host we crawled, and detection therefore undercounts. A visible interface also does not prove the mail service behind it is in active use, because abandoned installs outlive the mailboxes they served.

A single lookup confirms one host. The exported file answers the questions that only exist in aggregate: how many hosts still expose this interface, how the version spread is distributed across them, which countries and domain extensions concentrate them, what else runs on the same infrastructure, and how quickly the population is decaying from one export to the next. Nobody can assemble that picture domain by domain, which is precisely what the download is for.