Open-source competitive intelligence: from a public link to the operator behind it

Collection collapsed into one command

The 01-recon.sh script takes a domain and, in a single pass, runs WHOIS, DNS, certificate parsing, historical enumeration from certificate transparency, a HEAD request, public scans, passive DNS and the web archive. Each step lands as its own file in a working directory — an artifact you can return to, attach to a conclusion, and diff against a re-run of the same domain a month later. Intelligence that exists only in the analyst's terminal isn't intelligence.

The live click is a separate script — on purpose

The serving filter hands a neutral page to anyone who doesn't look like the intended visitor: wrong region, wrong device class, wrong referring source. So 02-live-click.sh issues the request with a genuine visitor's parameters and captures everything the hop exposes:

• the full redirect chain — every hop is a separate domain and, possibly, a separate party
• Set-Cookie at each hop — cookie names identify a platform far better than page content does
• response headers per hop: web server, framework tells, CDN identifiers
• the final response with real content — the thing the whole chain exists to deliver

Keeping this in its own file isn't cosmetic. It's the only step that sends a request with a substituted referring source, and it must never go out accidentally as part of routine collection. The reasoning is written into the script's header comment so the decision outlives its author.

Identify the tracker by signature, not by name

A tracker never introduces itself. But every platform leaves a fingerprint, and the fingerprint is more durable than anything printed on the page. The tracker-signatures.md reference is a "signal → platform" table that grows with every analysis:

• a service response header unique to one platform — the strongest signal, identification is instant
• cookie naming shape and structure — say, a name carrying a fixed-length hash plus a signed value
• the shape of the click URL path: where the campaign id sits, where the partner id sits
• the field set in an integration JSON payload — the key composition maps cleanly onto a platform family
• the load-balancer hostname in cloud DNS — often the operator's internal project codename

The code on the page says more about the team than the page does

A dedicated step reads the collected JS and CSS not for logic, but for traces of the authors: hard-coded service endpoints, internal entity names and — above all — comments written in a non-Latin script. One or two lines in a developer's native language narrow the candidate set more than the rest of the technical collection combined. It's a cheap step, and it's almost always skipped.

Attribution rules live in their own document, not in a closing paragraph

A chain involves several independent parties, not one: the masking layer, the tracker, an intermediate redirect service, the end merchant. Each is a separate company, and each may serve dozens of unrelated clients. So attribution-rules.md splits signals into two lists: those that prove a specific operator, and those that show up everywhere. The conclusion is drawn from the first unique signature in the chain — not from the last hop, and not from shared intermediate links.

Zero paid sources is a constraint, not a saving

The whole collection stands on what's available to anyone: registry whois servers, public DNS resolvers, certificate transparency, public page scans, passive DNS and the web archive. The constraint is methodologically useful: it forces you to rely on signals anyone can independently re-verify, rather than on the verdict of a closed service that can be neither challenged nor reproduced.

The most valuable result was catching my own mistake

On the third analysis the attribution was wrong at first. Two different chains converged on the same intermediate redirect service, and that looked like proof of shared ownership — a vivid, reproducible and entirely false signal. The error surfaced one step later: the response headers carried a tracker signature belonging to one specific platform and found nowhere else. The operator turned out to be a different one — and that was confirmed independently, through the public site of the platform's owner.

The rule that came out of it

Shared tools do not prove shared ownership. That sentence went into attribution-rules.md together with an explicit list of signals that prove nothing while looking convincing:

• anycast addresses of a popular CDN — a shared pool across every customer on the tier
• the most popular registrar and its default privacy provider — that's popularity, not a relationship
• a third-party redirect service mid-chain — independent SaaS used by dozens of unrelated operators
• a boilerplate landing template and the standard cookie set of a popular framework

The resulting algorithm is short: find the first hop carrying a unique signature, identify the platform from it, confirm with a second independent signal — and only then name an operator. Overlap in shared infrastructure enters the write-up as supporting evidence, never as the primary claim.

What's left after three analyses

A repository with the playbook, two reusable scripts and two reference documents that grow with each new chain. Plus a delivery checklist — the fields that must be filled before a conclusion counts as finished: who the operator is, where it's publicly corroborated, what the stack is, and exactly what proves the attribution. The checklist exists for the same reason the rules do: so the analyst's confidence never substitutes for evidence.