How Underhood works
Your DNS leaks your vendor list. Underhood reads what a company's public footprint gives away: a handful of DNS lookups and one homepage request. Everything we show, anyone could see, and every detection comes with the record it came from. We don't run JavaScript or crawl, so tools a page loads later stay invisible. That's on purpose: the footprint is the point.
Signals we read
header x-vercel-id: iad1::…script https://js.stripe.com/v3cookie __stripe_midCNAME www → cname.vercel-dns.comNS kate.ns.cloudflare.comMX aspmx.l.google.comSPF include:sendgrid.netTXT atlassian-domain-verification=…TXT _dmarc rua=…@ag.dmarcian.comIP 104.18.40.45 is in AS13335CNAME status.acme.com → x.stspg-customer.comMatching uses 210 DNS rules of our own (most found by scanning startups and looking at records we didn't recognise yet) and 3,435 page fingerprints from the open webappanalyzer project. TXT, MX and NS are read at the apex only: on www they would follow the CNAME and describe the host instead.
Confidence
No evidence, no detection. When signals disagree we show all of them and keep the strongest. The findings report counts medium and high only.
The rough bill
Each report has a collapsed Rough monthly bill (estimate). It multiplies public list prices by a guess at company size, taken from the site's rank in the Tranco top-sites list: XL is the top 1k, L the top 10k, M the top 100k, S everything else. Headcount guesses are 1–10, 10–100, 100–1,000 and 1,000+ people.
Usage-based services (Stripe, AWS, email volume…) are listed but never given a number, and neither is anything without a published price. Every price links to its source. Treat it as an order of magnitude, nothing more.
What we never do
- ×Store or show cookie values
- ×Log in, submit forms or run JavaScript
- ×Crawl: one homepage request per scan, no links followed
- ×Guess subdomains or send them requests: names come only from public certificate logs, and we only look up their DNS
- ×Probe ports (only 80/443 on the homepage, public addresses only)
- ×Keep page HTML. Only the detections and their evidence are kept
- ×Guess a database or backend language without direct evidence
What we can't see
- –Anything behind a login, or what runs inside subdomains like app. (we see where they point, not what they serve)
- –Tools loaded later by a tag manager (many chat widgets and analytics)
- –What's behind a CDN like Cloudflare (the origin is hidden)
- –Tools that need no DNS record or script, which is most SaaS
- –How much a company uses a tool. A verification record only proves an account exists
So a report is a lower bound: what's listed is there, but plenty more probably is too.
The bot
- User agent
- UnderhoodBot/0.1 (+https://github.com/yatharth1706/underhood)
- Per scan
- One GET to the homepage, at most 3 redirects, 4-second timeout, first 1.5 MB read
- Caching
- Each domain is scanned at most once a day; reports and the API reuse that result
- Rate limits
- 10 API scans and 30 report views per minute per visitor
- Batch scans
- For the findings report: at most 8 sites at a time, one request each, run by hand, not on a schedule
Opt out
If you run a domain and don't want it scanned, open an opt-out request with the domain name. We may ask you to confirm you control it, for example by adding a TXT record. Once it's on the opt-out list:
Credits
- Page fingerprints: webappanalyzer (GPL-3.0), the community fork of the open Wappalyzer rules.
- IP-to-ASN lookups: Team Cymru.
- YC company list: yc-oss/api.
- Logos: Simple Icons.
- Source code: GitHub.