Enrich 10,000 domains with HTTP/3, CDN edge, and stack signals in seconds

Domain Well-Known Protocol & App Link Signals Enricher

Extract evidence-backed B2B signals from public domain endpoints: Android assetlinks.json, iOS AASA, OpenID Connect/OAuth discovery, RFC 9116 security.txt, RFC 8461 mta-sts.txt, Apple merchant domain verification files, and /llms.txt.

---

⚡ The Acute B2B Pain vs. Instant Relief

The Problem in Modern Outbound & Account Qualification

When qualifying enterprise accounts in Clay, n8n, or internal GTM pipelines, answering technical questions usually requires fragile, expensive HTML scraping:

• Does this target account build native mobile apps? (Scraping App Store / Google Play breaks on anti-bot gates).
• Do they maintain an active vulnerability reporting program? (Manual inspection takes 15 minutes per domain).
• Do they enforce strict SMTP email encryption? (MTA-STS policies are buried in DNS and web endpoints).
• Do they curate modern AI/LLM markdown documentation? (/llms.txt).

The Direct Manifest Approach

Standard web scrapers crawl arbitrary HTML pages to guess tech stacks. In contrast, modern platforms publish machine-readable RFC manifests directly under /.well-known/. This Actor queries standardized protocol files directly at $0.001 per domain, returning tri-state verified evidence into your Clay tables or CRM.

---

💰 Pay-Per-Event (PPE) Pricing & Fair-Billing Model

Capability / Metric	Custom HTML Web Scraping	Standardized RFC Protocol Probing
Pricing Model	Variable compute / proxy costs	Fixed $0.001 per probed domain
Mobile App Link Discovery	Parses unpredictable HTML markup	Direct RFC assetlinks.json & AASA parsing
Vulnerability Policy (RFC 9116)	Requires custom regex scrapers	Direct security.txt & contact extraction
Email Security (RFC 8461)	Multi-step DNS + web scripts	Deterministic MTA-STS mode (enforce/testing)
Fair-Billing Policy	Billed on attempt regardless of failure	Unresolvable (NXDOMAIN/SSRF) domains = $0.00

[!NOTE]
Fair-Billing Policy: Custom event charges (domain-probed at $0.001) are assessed only when a domain scan completes. If an input domain fails DNS resolution (NXDOMAIN), triggers anti-SSRF IP blocks, or contains invalid syntax, it outputs with charged: false and events_charged: [].

---

🛡️ Tri-State Evidence Architecture (Zero False Negatives)

Most scrapers treat a blocked HTTP 403 response or a timeout as "Signal Not Found" (false). This Actor enforces a strict Tri-State Evidence Model:

Classification	Trigger Conditions	Business Interpretation
detected	HTTP 200 with valid, non-HTML payload parsed successfully.	Signal confirmed present on domain.
not_found	HTTP 404 or HTTP 410 returned by server.	Signal confirmed absent.
blocked_or_challenged	HTTP 401, 403, 429, 503, or WAF challenge headers (Cloudflare, AWS WAF).	Endpoint protected by access gates; capability cannot be ruled out.
invalid_format	HTTP 200 returning HTML (<!DOCTYPE html> or <html) when expecting JSON/RFC text.	Soft-200 SPA catch-all fallback or parking page; filtered out to eliminate false positives.
unreachable	DNS failure (NXDOMAIN), connection timeout, or TLS handshake error.	Target domain or host is offline or unresolvable.

Every probe records status, http_status, evidence_url, content_type, confidence, and descriptive audit notes.

---

⚠️ Explicit Signal Boundaries & Non-Claims

To preserve 100% technical integrity and regulatory compliance:

• Mobile App Link Manifests (assetlinks.json / AASA): Proves which mobile applications are specifically configured for domain-associated deep linking. It does NOT represent a company's complete mobile app inventory (internal or non-linked apps will not appear).
• Apple Merchant Association File: Proves that the domain hosts Apple's merchant domain verification file for Apple Pay on the Web. It does NOT prove that Apple Pay is actively offered at checkout.
• RFC 9116 security.txt: Proves the existence of a vulnerability disclosure intake channel. It does NOT certify ISO 27001 or SOC 2 compliance.
• WAF Limitations: Domains with aggressive anti-bot protections may challenge automated probes; these are labeled honestly as blocked_or_challenged.

---

📊 Live Side-by-Side Verification (Real Production Data)

Target Account	Domain	Android App Links	iOS Universal Links	RFC 9116 Security.txt	MTA-STS	Apple Merchant File
Linear	linear.app	detected (4 packages)	detected (com.linear)	detected (HackerOne URI)	none	not_found
Vercel	vercel.com	not_found	not_found	detected (security email)	none	not_found
Supabase	supabase.com	not_found	not_found	detected (disclosure URI)	none	not_found
Gymshark	gymshark.com	detected (1 package)	detected (1 App ID)	not_found	none	detected (Apple Pay)
Inngest	inngest.com	not_found	not_found	not_found	none	not_found

---

⚡ 1-Click Clay Table Integration Recipe

Enrich B2B sales lists with mobile engineering signals, security posture, and MTA-STS email transport security:

1. Clay Action: HTTP API Request
2. Method: POST
3. URL: https://api.apify.com/v2/acts/deepaksheoran172~domain-protocol-signals-enricher/run-sync-get-dataset-items
4. Headers:
   • Content-Type: application/json
   • Authorization: Bearer YOUR_APIFY_TOKEN (Configure securely via Clay Headers account)
5. Body:

   {
     "domains": ["{{company.domain}}"],
     "concurrency": 5,
     "request_timeout_secs": 10
   }
   

6. Clay Formula Extractions (Verified Schema):
   • Has Android App: {{data[0].android_app_links_status == "detected"}}
   • Android Packages: {{data[0].android_package_names}}
   • Has iOS App: {{data[0].ios_aasa_status == "detected"}}
   • Vulnerability Disclosure: {{data[0].security_txt_status}}
   • Security Intake Contact: {{data[0].security_contacts[0]}}
   • MTA-STS Strict Mode: {{data[0].mta_sts_mode == "enforce"}}
   • Hosts Apple Pay File: {{data[0].apple_merchant_file_status == "detected"}}

---

🚀 1-Click n8n Automated Cron Pipeline

Automate daily account enrichment using our pre-wired workflow:

1. Open n8n -> Workflow > Import from URL.
2. Paste: https://raw.githubusercontent.com/deepakshe/apify-b2b-super-actors/main/workflows/tool7_domain_protocol_enricher_n8n.json
3. Set your APIFY_API_TOKEN environment variable and run scheduled batches with zero code.

---

🤖 Claude Desktop & Cursor IDE (MCP Integration)

Connect directly to Apify's official remote MCP endpoint (mcp.apify.com) using Streamable HTTP:

{
  "mcpServers": {
    "domain-protocol-enricher": {
      "url": "https://mcp.apify.com/?tools=deepaksheoran172/domain-protocol-signals-enricher",
      "headers": {
        "Authorization": "Bearer YOUR_APIFY_TOKEN"
      }
    }
  }
}

---

🔒 Security & Anti-SSRF Architecture

• Pre-Flight DNS Resolution: Target hostnames are resolved and checked against RFC 1918 private ranges, loopback (127.0.0.0/8, ::1), and cloud metadata (169.254.169.254) before any network socket is opened.
• Redirect Re-Validation: Every HTTP redirect hop re-validates the destination IP via SSRFSafeRedirectHandler.
• Streaming Buffer Cap: HTTP response streams are strictly capped at 1 MB to prevent decompression bombs.

---

🚀 Ready to Enrich Your Domain Signals?

Audit your target account domains for RFC security and app-linking protocols in seconds:

1. Click Try for free at the top right of this page.
2. Enter a list of domains or import a CSV from Clay/HubSpot.
3. Export enriched technographic data to JSON, CSV, or direct webhooks.

---

📄 License

MIT © Deepak Sheoran