← Builds
Public data
Detect 163 B2B tools from a company's website and DNS
A crawler that reads company websites, DNS records and subdomains and matches them against hand-verified fingerprints: visitor identification, CRM, marketing automation, hiring tools and more. The free, self-built version of paid technographic data, run on Belgian companies.
Works ifYour product replaces, integrates with or sells to users of specific tools.
Built for · Kestrel's own data
Get the prompt for your coding agentThe system
~/builds/detect-company-tech
01Source
Company universe
Belgian companies with a domain
Free People Data Labs dataset.
Two-tier crawlHTTP first, render only when needed
02Detect
Website
Scripts, globals, cookies
DNS
TXT, SPF, DKIM, DMARC
34 tools
Subdomains
CNAME to a vendor
24 tools
Score the stacktiers A to D
Every company tagged with its stack and a tier.
The signal
A company runs a specific tool, visible in its website code, DNS records or subdomains.
Why it predicts a purchase
The tools a company pays for show how it sells. A visitor-identification pixel points to an outbound motion, an Ashby careers page to an early-stage company that is hiring, a Salesforce subdomain to a real sales org.
How it works
01
Start from a company universe
The free People Data Labs company dataset, filtered to Belgian companies that have a domain, loaded into DuckDB.
02
Cheap fetch first, render only when needed
Every homepage is fetched over plain HTTP. Only pages that load a tag manager but show no high-signal tool get a full Playwright render, because that is where injected pixels hide.
03
Read DNS and subdomains
TXT, SPF, DKIM and DMARC records and subdomain CNAMEs catch the tools that have no pixel.
04
Score the stack
Tier A: two or more high-signal tools, or one plus a software industry. B: one high-signal tool, or a tool plus a software industry. C: any tool. D: none.
All 163 tools
Every tool the crawler detects, and exactly what gives it away. Check any company yourself with view-source and a DNS lookup.
ToolCategoryLayerHow to spot it
- FCR MediaAgency-built sitesWebsiteloads fcrmedia.be
- YoolsAgency-built sitesWebsiteloads yools.be
- Google Analytics 4AnalyticsWebsiteloads googletagmanager.com/gtag/js · loads google-analytics.com · window.gtag · cookie _ga_
- HotjarAnalyticsWebsiteloads static.hotjar.com · loads script.hotjar.com · loads hotjar.io · window.hj
- MatomoAnalyticsWebsiteloads matomo.cloud · loads matomo.js · window._paq · window.Matomo
- AshbyATS / careersWebsiteloads ashbyhq.com
- AshbyATS / careersSubdomaina subdomain points to ashbyhq.com
- CarerixATS / careersWebsiteloads carerix.com
- ConnexysATS / careersWebsiteloads connexys.nl
- CVWarehouseATS / careersWebsiteloads cvwarehouse.com · loads cvw.io
- GreenhouseATS / careersWebsiteloads boards.greenhouse.io · loads boards-api.greenhouse.io · loads grnhse.io · window.Grnhse
- GreenhouseATS / careersSubdomaina subdomain points to greenhouse.io
- Greenhouse (hiring)ATS / careersDNSTXT record contains greenhouse.io
- HomerunATS / careersWebsiteloads homerun.co
- JobtoolzATS / careersWebsiteloads jobtoolz-assets.imgix.net · loads jobtoolz.com
- LeverATS / careersWebsiteloads jobs.lever.co · loads api.lever.co
- LeverATS / careersSubdomaina subdomain points to lever.co
- OTYSATS / careersWebsiteloads ows.otys.nl · loads .otys.nl
- PersonioATS / careersWebsiteloads jobs.personio.de · loads jobs.personio.com
- PratoATS / careersWebsiteloads prato.be
- RecruiteeATS / careersWebsiteloads recruitee.com
- SmartRecruitersATS / careersWebsiteloads smartrecruiters.com
- TalentfinderATS / careersWebsiteloads talentfinder.be
- TeamtailorATS / careersWebsiteloads teamtailor.com · loads teamtailor-cdn.com
- WorkableATS / careersWebsiteloads workable.com
- WorkdayATS / careersWebsiteloads myworkdayjobs.com · loads myworkdaysite.com
- WorkdayATS / careersSubdomaina subdomain points to myworkdayjobs.com
- Zuora (billing = is-a-SaaS)BillingDNSTXT record contains zuora.com
- mParticleCDPWebsiteloads jssdkcdns.mparticle.com · loads jssdkcdn.mparticle.com · window.mParticle
- RudderStackCDPWebsiteloads cdn.rudderlabs.com · loads cdn.rudderstack.com · window.rudderanalytics · cookie rl_anonymous_id
- Salesforce Data 360CDPWebsiteloads cdn.c360a.salesforce.com · window.SalesforceInteractions
- SegmentCDPWebsiteloads cdn.segment.com · window.analytics · cookie ajs_anonymous_id
- Simon DataCDPWebsiteloads simondata.com · window._sd
- TealiumCDPWebsiteloads tags.tiqcdn.com · window.utag
- Treasure DataCDPWebsiteloads cdn.treasuredata.com · window.Treasure · cookie _td
- AxeptioConsentWebsiteloads static.axept.io · loads axeptio.imgix.net · window.axeptioSettings · window._axcb
- ComplianzConsentWebsiteloads cookiedatabase.org · loads complianz-gpdr · loads complianz-gdpr · window.cmplz · cookie cmplz_policy_id · cookie cmplz_marketing
- CookieHubConsentWebsiteloads cdn.cookiehub.eu · loads cookiehub.net · window.cookiehub
- OneTrustConsentWebsiteloads cdn.cookielaw.org · loads otSDKStub · window.OneTrust · window.OptanonWrapper · cookie OptanonConsent
- AttioCRMDNSTXT record contains attio-domain-verification
- HubSpotCRMWebsiteloads js.hs-scripts.com · loads js.hs-analytics.net · loads js.hsforms.net · loads js.usemessages.com · loads hs-banner.com · loads hsforms.com · loads hsadspixel.net · loads hscollectedforms.net · window._hsq · window.hbspt · window.HubSpotConversations · cookie hubspotutk · cookie __hstc
- HubSpot (CMS)CRMSubdomaina subdomain points to hubspot.net · a subdomain points to hs-sites.com
- Microsoft Dynamics 365CRMSubdomaina subdomain points to dynamics.com
- Pipedrive LeadBoosterCRMWebsiteloads leadbooster-chat.pipedrive.com · loads webforms.pipedrive.com · window.LeadBooster
- SalesforceCRMSubdomaina subdomain points to my.salesforce.com · a subdomain points to force.com
- Salesforce Experience CloudCRMSubdomaina subdomain points to my.site.com · a subdomain points to live.siteforce.com
- AgariDeliverabilityDNSDMARC record contains agari.com
- dmarcianDeliverabilityDNSDMARC record contains dmarcian.com
- Red Sift OnDMARCDeliverabilityDNSDMARC record contains ondmarc.com
- ValimailDeliverabilityDNSDMARC record contains vali.email
- GitBookDocsSubdomaina subdomain points to gitbook.io
- MintlifyDocsSubdomaina subdomain points to mintlify
- ReadMeDocsSubdomaina subdomain points to readme.io · a subdomain points to readmessl.com
- ShopifyEcommerceWebsiteloads cdn.shopify.com · loads shopifysvc.com · window.Shopify
- DripEcommerce emailWebsiteloads tag.getdrip.com · window._dcq · cookie _drip_client
- KlaviyoEcommerce emailDNSCNAME kl._domainkey contains sendgrid.net
- MailchimpEcommerce emailDNSTXT record contains mcsv.net
- MoosendEcommerce emailDNSTXT record contains spfa.mailendo.com
- SmartschoolEducationWebsiteloads smartschool.be
- BrevoEmail marketingWebsiteloads sibautomation.com · loads sibforms.com · loads cdn.brevo.com · window.sib
- BrevoEmail marketingDNSTXT record contains spf.brevo.com · CNAME brevo1._domainkey contains brevo.com
- Campaign MonitorEmail marketingDNSTXT record contains _spf.createsend.com
- Constant ContactEmail marketingWebsiteloads static.ctctcdn.com
- Constant ContactEmail marketingDNSCNAME ctct1._domainkey contains ccsend.com
- EmmaEmail marketingDNSTXT record contains e2ma-verification=
- GetResponseEmail marketingDNSTXT record contains _spf.getresponse.com
- GoHighLevelEmail marketingWebsiteloads widgets.leadconnectorhq.com · loads msgsndr.com
- Kit (ConvertKit)Email marketingWebsiteloads f.convertkit.com
- Kit (ConvertKit)Email marketingDNSCNAME cka._domainkey contains convertkit.com
- KlaviyoEmail marketingWebsiteloads static.klaviyo.com · loads a.klaviyo.com · loads static-tracking.klaviyo.com · window.klaviyo · window._klOnsite · window._learnq · cookie __kla_id
- MailerLiteEmail marketingWebsiteloads assets.mailerlite.com
- MailerLiteEmail marketingDNSTXT record contains _spf.mlsend.com
- NetcoreEmail marketingDNSTXT record contains netcorecloud.net
- RD StationEmail marketingWebsiteloads d335luupugsy2.cloudfront.net · window.RDStationForms
- SendPulseEmail marketingDNSTXT record contains mxsspf.sendpulse.com
- ProofpointEmail securityDNSDMARC record contains proofpoint.com
- Clearbit / BreezeEnrichmentWebsiteloads x.clearbitjs.com
- OdooERPWebsiteloads odoo.com · window.odoo
- Amazon SESEmail sendingDNSTXT record contains amazonses.com
- MailgunEmail sendingDNSTXT record contains mailgun.org
- SendGridEmail sendingDNSCNAME s1._domainkey contains sendgrid.net
- AtlassianFirmographicSubdomaina subdomain points to atlassian.net
- Adobe FontsFontsWebsiteloads use.typekit.net · window.Typekit
- CombellHostingDNSNS record contains combell.net · NS record contains combell.eu · MX record contains mailprotect.be
- OVHcloudHostingDNSNS record contains ovh.net · NS record contains anycast.me · MX record contains mail.ovh.net
- Auth0IdentitySubdomaina subdomain points to auth0.com
- OktaIdentitySubdomaina subdomain points to okta.com
- 6senseIntentWebsiteloads 6sc.co · window._6si
- BomboraIntentWebsiteloads ml314.com
- Delivr.aiIntentWebsiteloads delivr.ai/pixel.js
- DemandbaseIntentWebsiteloads tag.demandbase.com · loads scripts.demandbase.com · loads secure.company-target.com · window.Demandbase
- Factors.aiIntentWebsiteloads api.factors.ai · loads app.factors.ai/assets/factors.js · window.factors
- N.RichIntentWebsiteloads j.nrich.ai · window._nrich
- DriftLive chatWebsiteloads js.driftt.com · loads js.drift.com · window.drift
- IntercomLive chatWebsiteloads widget.intercom.io · loads js.intercomcdn.com · loads api-iam.intercom.io · window.Intercom · window.intercomSettings · cookie intercom-id-
- Act-OnMarketing automationDNSTXT record contains act-on.net
- ActiveCampaignMarketing automationWebsiteloads trackcmp.net · window.vgo · cookie ac_enable_tracking
- Customer.ioMarketing automationWebsiteloads cdp.customer.io · loads track.customer.io · window._cio · cookie _cioid · cookie _cioanonid
- Customer.ioMarketing automationDNSTXT record contains customeriomail.com
- HubSpot (email)Marketing automationDNSTXT record contains hubspotemail.net
- InflectionMarketing automationWebsiteloads tracking.inflection.io
- MarketoMarketing automationWebsiteloads munchkin.js · loads .mktoresp.com · loads mktoweb.com · window.Munchkin
- MarketoMarketing automationDNSTXT record contains mktomail.com
- Oracle EloquaMarketing automationDNSTXT record contains eloqua.com
- Salesforce Marketing CloudMarketing automationSubdomaina subdomain points to exacttarget.com · a subdomain points to marketingcloudapps.com · a subdomain points to sfmc-marketing.com · a subdomain points to exct.net
- Salesforce PardotMarketing automationWebsiteloads pi.pardot.com · loads pd.pardot.com · window.piAId
- Salesforce PardotMarketing automationDNSTXT record contains pardot.com
- SAP EmarsysMarketing automationDNSTXT record contains emarsys
- StripePaymentsWebsiteloads js.stripe.com · loads m.stripe.network · window.Stripe · cookie __stripe_mid
- Chili PiperPLGWebsiteloads js.chilipiper.com · window.ChiliPiper
- DefaultPLGWebsiteloads pixel-cdn.default.com · loads import-cdn.default.com
- MadKuduPLGWebsiteloads cdn.madkudu.com
- NavatticPLGWebsiteloads js.navattic.com · loads capture.navattic.com · window.navattic
- PathfactoryPLGWebsiteloads cdn.pathfactory.com
- QualifiedPLGWebsiteloads js.qualified.com · window.qualified
- Reo.devPLGWebsiteloads api.reo.dev
- WonderPushPush notificationsWebsiteloads cdn.by.wonderpush.com · window.WonderPush
- ZabunReal estateWebsiteloads zabun.be
- The Feedback CompanyReviewsWebsiteloads feedbackcompany.com · loads feedbackcompany.nl
- DockSales enablementSubdomaina subdomain points to dock.us
- HighspotSales enablementSubdomaina subdomain points to highspot.com
- MindtickleSales enablementSubdomaina subdomain points to mindtickle.com
- SeismicSales enablementSubdomaina subdomain points to seismic.com
- ShowpadSales enablementSubdomaina subdomain points to showpad.biz
- KnowBe4 (has IT budget)SecurityDNSTXT record contains knowbe4.com
- InstatusStatusSubdomaina subdomain points to instatus.com
- StatuspageStatusSubdomaina subdomain points to stspg-customer.com · a subdomain points to statuspage.io
- IntercomSupportSubdomaina subdomain points to intercom.help
- ZendeskSupportSubdomaina subdomain points to zendesk.com
- Zendesk (support)SupportDNSTXT record contains mail.zendesk.com
- AlbacrossVisitor identificationWebsiteloads serve.albacross.com · loads n.albacross.com · window.Albacross · window._nQc · cookie nQ_visitId · cookie AlbacrossOrg
- Apollo (website tracker)Visitor identificationWebsiteloads assets.apollo.io/micro/website-tracker
- ArtisanVisitor identificationWebsiteloads artisan.co
- Clay Web IntentVisitor identificationWebsiteloads claydar.com · window.Claydar
- Common RoomVisitor identificationWebsiteloads cr-relay.com
- DatashopperVisitor identificationWebsiteloads datashopper.com
- DriveniqVisitor identificationWebsiteloads driveniq.com
- Dun & BradstreetVisitor identificationWebsiteloads d41.co
- getuntitled.aiVisitor identificationWebsiteloads getuntitled.ai
- Happier LeadsVisitor identificationWebsiteloads revealid.xyz
- IdentityMatrixVisitor identificationWebsiteloads identitymatrix.ai
- Instantly / LeadsyVisitor identificationWebsiteloads r2.leadsy.ai
- KickFireVisitor identificationWebsiteloads kickfire.com
- KoalaVisitor identificationWebsiteloads getkoala.com · window.globalKoalaKey
- Lead ForensicsVisitor identificationWebsiteloads secure.leadforensics.com
- Leadfeeder / DealfrontVisitor identificationWebsiteloads sc.lfeeder.com · window.ldfdr · cookie _lfa
- LeadinfoVisitor identificationWebsiteloads cdn.leadinfo.net · loads leadinfo.com · window.leadinfo
- LeadLanderVisitor identificationWebsiteloads leadlander.com
- LeadpipeVisitor identificationWebsiteloads leadpipe.com
- Pearl DiverVisitor identificationWebsiteloads pearldiver.io
- PropensityVisitor identificationWebsiteloads propensity.com
- ProspectDeskVisitor identificationWebsiteloads prospectdesk.ai
- RB2BVisitor identificationWebsiteloads b2bjsstore · window.reb2b
- SalespanelVisitor identificationWebsiteloads salespanel.io
- SalesViewerVisitor identificationWebsiteloads salesviewer.com · loads svrdntfctn.com · loads slsnlytcs.com · loads slsntllgnc.com
- SmartRecognitionVisitor identificationWebsiteloads smartrecognition.com
- Snitcher / LemlistVisitor identificationWebsiteloads cdn.snitcher.com
- SwanVisitor identificationWebsiteloads getswan.com
- TerminusVisitor identificationWebsiteloads terminus.services
- VectorVisitor identificationWebsiteloads api.vector.co · loads vector.co · window.vector
- VisitorQueueVisitor identificationWebsiteloads visitorqueue.com
- WarmlyVisitor identificationWebsiteloads getwarmly.com · loads opps-widget.getwarmly.com
- ZoomInfo WebSightsVisitor identificationWebsiteloads ws.zoominfo.com/pixel · loads js.zi-scripts.com · window.ZoomInfoFormComplete
- DudaWebsite builderWebsiteloads cdn-website.com · window.dmAPI
- FramerWebsite builderWebsiteloads framerusercontent.com · loads events.framer.com · window.__framer_events
- GoDaddy Website BuilderWebsite builderWebsiteloads img.wsimg.com
- JimdoWebsite builderWebsiteloads jimstatic.com · loads jimcdn.com
- JouwWebWebsite builderWebsiteloads jwwb.nl · loads jouwweb.be
- SquarespaceWebsite builderWebsiteloads squarespace-cdn.com · loads sqspcdn.com · loads static1.squarespace.com · cookie crumb
- WebflowWebsite builderWebsiteloads website-files.com · window.Webflow
- WebHeroWebsite builderWebsiteloads webhero.be
- WebnodeWebsite builderWebsiteloads clvaw-cdnwnd.com
- WeeblyWebsite builderWebsiteloads editmysite.com · loads weeblycloud.com
- WixWebsite builderWebsiteloads wixstatic.com · loads wixsite.com · loads parastorage.com · window.wixBiSession · cookie svSession
- ElfsightWidgetsWebsiteloads elfsightcdn.com · loads static.elfsight.com
- TrustindexWidgetsWebsiteloads cdn.trustindex.io · loads trustindex.io
176 of 176 rows. One row per tool per layer.
Build notes
- RB2B's beacon loads from a shared S3 path, not from rb2b.com.
- Common Room's beacon is cr-relay.com, not commonroom.io.
- Lemlist's pixel is white-labeled Snitcher.
- Attio has no web pixel. The TXT verification record is the only tell.
Questions
Which tools can't be detected?
Cold email tools that send through the customer's own mailbox (Outreach, Salesloft, Apollo, Instantly, Lemlist) leave no DNS trace; only their website pixels show. Call recorders like Gong leave nothing public. Server-side installs leave no pixel at all.
Why check DNS and subdomains as well as the website?
Some tools have no website pixel. Attio shows up only as a TXT verification record, email platforms in SPF, DKIM and DMARC records, and hiring and help-centre tools as subdomains pointing to the vendor.
More builds
All builds →Public data
Reach companies before their public deadline
Your buyers make public promises with a deadline.
Open→
Public data
Reach companies hiring for what you sell
You sell a service that companies also try to hire for.
Open→
Public data
Find buyers in certification registries
Your buyers can hold a certificate or standard that proves they care.
Open→
The next step