Website Indicators

Each indicator is associated with an evidentiary tier and is subject to interpretation.

• Tier 1 indicators are typically unique or highly indicative of the provenance of a website. This includes unique IDs for verification purposes and web services like Google, Yandex, etc as well as site metadata like WHOIS information and certification, when valid, as DDOS protection services like Cloudflare and shared hosting services like Bluehost can provide spurious matches.
• Tier 2 indicators offer a moderate level of certainty regarding the provenance of a website. These are not as unique as Tier 1 indicators but provide valuable context. This tier includes IPs within the same subnet, matching meta tags, and commonalities in standard and custom response headers.
• Tier 3 indicators are the least specific but can still support broader analyses when combined with higher-tier indicators. These include shared CSS classes, UUIDs, and Content Management Systems.

Select an indicator type to view all: All Types 1-cert-domain (Domain Certificate) 1-crypto-wallet (Cryptocurrency Wallet) 1-domain (Domain Name) 1-domain_suffix (Domain Suffix) 1-fb_pixel_id (Facebook Pixel ID) 1-adobe_analytics_id (Adobe Analytics ID) 3-sitemap_entries (Sitemap Entries) 3-ipms_domain_iprangeowner_cidr (IP Range Owner CIDR) 3-ipms_domain_iprangeowner_ownerName (IP Range Owner Name) 3-ipms_domain_iprangeowner_address (IP Range Owner Address) 3-ipms_domain_nameserver (Domain Name Server) 3-ipms_domain_otheripused (Other IPs Used by Domain) 3-ipms_siteonthisip_now (Current Sites on This IP) 3-ipms_siteonthisip_before (Former Sites on This IP) 3-ipms_siteonthisip_broken (Broken Sites on This IP) 3-ipms_useragents (User Agents) 1-ip_shodan_hostnames (Shodan Hostnames) 3-ip_shodan_ports (Shodan Ports) 2-ip_shodan_vuln (Shodan Vulnerabilities) 3-ip_shodan_cpe (Shodan CPE) 1-ga_id (Google Analytics ID) 1-ga_tag_id (Google Analytics Tag ID) 1-ip (IP Address) 1-verification_id (Verification ID) 1-yandex_tag_id (Yandex Tag ID) 2-subnet (Subnet) 3-cdn-domain (CDN Domain) 3-cms (Content Management System) 3-css_classes (CSS Classes) 3-header-nonstd-value (Non-Standard Header Value) 3-header-server (Server Header) 3-id_tags (ID Tags) 3-iframe_id_tags (Iframe ID Tags) 3-link_href (Link Href Attributes) 3-meta_generic (Generic Meta Tags) 3-meta_social (Social Media Meta Tags) 3-script_src (Script Source Attributes) 3-uuid (UUID) 3-whois_creation_date (WHOIS Creation Date) 3-whois_server (WHOIS Server) 3-whois-registrar (WHOIS Registrar) 3-wp-blocks (WordPress Blocks) 3-wp-categories (WordPress Categories) 3-wp-pages (WordPress Pages) 3-wp-posts (WordPress Posts) 3-wp-tags (WordPress Tags) 3-wp-users (WordPress Users) 2-urlscan_globalvariable (URLScan Global Variable) 2-urlscan_cookies (URLScan Cookies) 2-urlscan_consolemessages (URLScan Console Messages) 2-urlscan_asn (URLScan Autonomous System Number) 2-urlscan_domainsonpage (URLScan Domains on Page) 2-urlscan_urlssonpage (URLScan URLs on Page) 2-urlscanhrefs (URLScan Hrefs) 2-techstack (Technology Stack) 2-ads_txt (Ads.txt File) 3-footer-text (Footer Text) 4-outbound-domain (Outbound Domain) 3-twitter (Twitter Link) 3-facebook (Facebook Link) 3-youtube (YouTube Link) 3-telegram (Telegram Link) 3-outbound-domain (Outbound Domain) 3-patreon (Patreon Link) 3-gab (Gab Link)

Domain Name	Indicator Type	Indicator Content

About and Interpreting Indicators