Website Tech Stack & Lead Enrichment Scraper

Turn a list of domains into rich, structured company profiles — technology stack, advertising pixel IDs, contact details, e-mail infrastructure, hosting and firmographic signals.

No browser, no JavaScript rendering — just fast HTTP and DNS. That is why this Actor costs a fraction of a browser-based crawler and can process tens of thousands of domains in a single run.

Input:   gymshark.com
Output:  Shopify · Klaviyo · Attentive · Judge.me · Recharge · Meta Pixel 12345…
         Google Workspace · DMARC p=reject · Cloudflare · hello@… · 6 socials
         martechMaturityScore 78 · runsPaidAds true · isHiring true

---

What you get for every domain

Group	Fields
Technology stack	300+ fingerprints across 45 categories — e-commerce platform, CMS, page builder, JS framework, CDN, hosting, analytics, advertising, CRM, e-mail marketing, SMS, live chat, reviews, payments, BNPL, subscriptions, search, personalisation, loyalty, cookie consent, bot protection, error tracking, auth. Each detection carries a version, a confidence score and the evidence that matched, so you can audit anything you don't trust.
Ad pixel & tracking IDs	Actual account IDs — Meta Pixel, Google Ads, GA4, Universal Analytics, GTM, TikTok, LinkedIn, Pinterest, Snap, Reddit, X, Microsoft UET, Hotjar, Klaviyo, HubSpot, Intercom, Segment, Amplitude, Mixpanel — plus adPixelCount.
Contacts	E-mail addresses split into role and personal, phone numbers, postal addresses, country code, and the contact/about page URLs.
Social profiles	Canonical LinkedIn, Facebook, Instagram, X, YouTube, TikTok, Pinterest, GitHub, Reddit and Threads URLs. Share buttons and individual posts are filtered out.
E-mail infrastructure	Mailbox provider, MX records, SPF policy, every third-party sender authorised in SPF, DMARC policy and reporting addresses, resolving DKIM selectors, BIMI, an isSpoofable flag and a 0–100 security score.
Commerce	Platform, Shopify theme / plan tier / store ID, currency, payment providers, BNPL, cart & checkout presence, and installed store-front apps.
DNS & hosting	A/AAAA, nameservers, DNS operator, SaaS domain-verification tokens, CDN, hosting provider, server software, edge PoP.
TLS (optional)	Issuer, validity, days to expiry, and the Subject Alternative Names that expose a company's other brands and staging hosts.
Security headers	HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, security.txt, 0–100 score.
Pages & robots	Sitemaps, which AI crawlers are blocked, and the pricing / careers / blog / login / docs / app-subdomain URLs.
Business signals	B2B-SaaS or agency classification, free trial, demo CTA, hiring, newsletter, live chat, paid advertising, server-side tagging, cookie consent, a 0–100 martech maturity score, and plain-English highlights.

---

Who this is for

• Outbound sales & lead gen — build "runs Shopify Plus + Klaviyo but not Attentive" target lists, then enrich them with e-mails and LinkedIn URLs in the same pass.
• Agencies — qualify prospects before the call. You know their platform, ad channels, ESP and martech maturity before you dial.
• Competitive intelligence — track which vendors your market is adopting, at scale, on a schedule.
• Data teams — a stable, documented, fixed-column schema that loads straight into BigQuery, Snowflake or pandas. Every field is always present (null when not collected), so your table never changes shape between runs.
• E-mail deliverability & security vendors — the isSpoofable flag plus DMARC policy is a ready-made prospect list.

---

Input

Paste domains, one per line. Bare domains, full URLs and even e-mail addresses all work.

{
  "domains": ["gymshark.com", "https://www.stripe.com/pricing", "jane@notion.so"],
  "enrichContacts": true,
  "enrichEmailInfrastructure": true,
  "expandTagManager": true,
  "maxConcurrency": 40
}

You can also pass startUrls (to chain this Actor onto another one) or sourceDatasetId (to enrich a dataset produced by an earlier run — no CSV round-trip).

Duplicates and www/apex variants of the same site are merged automatically, so a messy list never bills you twice for one company.

Options

Option	Default	Notes
enrichContacts	true	Fetches contact/about/imprint pages. Roughly doubles the number of populated fields.
enrichEmailInfrastructure	true	Pure DNS — fast and very cheap.
expandTagManager	true	Strongly recommended. See below.
enrichTls	false	Adds a TLS handshake and one request per domain.
maxExtraPages	2	Contact/about/imprint pages fetched per domain.
maxConcurrency	40	About 20 per GB of assigned memory is a good rule of thumb.
maxHtmlKb	1000	See the trade-off below.
flattenOutput	false	Turn on for CSV/spreadsheets; leave off for warehouses.
skipFailedDomains	false	Off keeps your input and output aligned row-for-row.
proxyConfiguration	disabled	Usually unnecessary. See the FAQ.

Why expandTagManager matters

Most sites no longer put ad pixels in their HTML. They load them through Google Tag Manager, and Shopify stores route them through a sandboxed Web Pixels Manager — so fbq( never appears in the markup and naive scrapers report nothing.

This Actor reads the site's GTM container and extracts the tags configured inside it. In testing, that lifted ad-pixel coverage from 4% to 45% of sites. It only fires on domains that actually use GTM.

Choosing maxHtmlKb

Contact details live in page footers, so capping the HTML too low costs you data:

maxHtmlKb	E-mails found	Phones found
400	37%	11%
1000 (default)	59%	22%
2500	63%	26%

1000 KB is the sweet spot. Lower it if you only care about technographics.

---

Output

One record per input domain, nested JSON by default. Abbreviated:

{
  "input": "gymshark.com",
  "domain": "gymshark.com",
  "url": "https://www.gymshark.com/",
  "success": true,
  "site": { "companyName": "Gymshark", "language": "en-gb", "currencies": ["GBP"] },
  "technologies": [
    { "name": "Shopify", "category": "ecommerce", "version": null,
      "confidence": 100, "evidence": "header: x-shopid",
      "website": "https://www.shopify.com" }
  ],
  "technologiesByCategory": {
    "ecommerce": ["Shopify"], "email-marketing": ["Klaviyo"], "reviews": ["Judge.me"]
  },
  "trackingIds": { "metaPixel": ["1234567890123456"], "googleAnalytics4": ["G-ABCD123456"], "adPixelCount": 3 },
  "contacts": { "emails": ["hello@gymshark.com"], "roleEmails": ["hello@gymshark.com"], "phones": [] },
  "socialProfiles": { "instagram": "https://www.instagram.com/gymshark", "count": 6 },
  "emailInfrastructure": { "provider": "Google Workspace", "dmarcPolicy": "reject",
                           "detectedSenders": ["Klaviyo", "SendGrid"], "isSpoofable": false,
                           "securityScore": 95 },
  "signals": { "runsPaidAds": true, "martechMaturityScore": 78,
               "highlights": ["Runs Shopify", "Advertises on Meta, TikTok", "E-mail via Klaviyo"] }
}

Set flattenOutput: true for one flat row of dot-notation columns with arrays joined by " | " — ready for CSV or a spreadsheet.

Failed domains still produce a row (success: false, plus an errorCode), so your output stays aligned with your input list. Set skipFailedDomains: true if you'd rather drop them.

The dataset ships with ready-made views — Overview, Lead list, Tech stack, Ad pixels and E-mail infrastructure — so you can export just the columns you need without writing a transformation.

---

What to expect

Typical coverage per successfully profiled domain:

Measured on a 60-domain sample weighted toward large enterprise retailers and bot-protected sites, at default settings:

Field	Populated
Company name	98%
DNS / MX / DMARC	100% / 100% / 100%
Social profile	87%
E-mail address	63%
Ad pixel IDs	50%
Phone number	28%
Profiled successfully	90%

Coverage depends on the site: a small business with a footer full of contact details fills nearly every field, while a large enterprise site that renders everything client-side fills fewer.

The 10% that failed were dead domains and sites behind aggressive bot management that return 403 to any non-browser client. Domains that fail are never charged.

Accuracy

A false positive in a lead list is worse than a gap — it silently poisons your segmentation. Fingerprints are anchored on vendor-owned hostnames, cookie names and script paths, never on a bare product name, so a page that merely mentions thirty vendors on an integrations page returns zero detections.

Every detection includes an evidence field naming exactly what matched, so you can verify any row yourself.

Known limits:

• Content rendered purely client-side is invisible — there is no browser. This is the deliberate trade-off that makes the Actor fast and cheap.
• Sites behind aggressive bot management (Cloudflare Bot Management, DataDome, Akamai) block plain HTTP clients.
• Pixel IDs are recovered from page markup, GTM containers and Shopify's cart-page pixel config. Sites that dispatch ad tags server-side through a CDP (mParticle, Segment, Tealium) or Shopify's sandboxed pixel runtime keep the IDs in a remote config that no HTTP client can read — a browser extension sees them only because it observes the page after that config loads. For those sites runsPaidAds is false but signals.usesServerSideTagging is true, and the highlights name the dispatcher. Filter on runsPaidAds || usesServerSideTagging to catch every advertiser.
• productCount is only reported when a page states one outright, rather than guessed from link counts.

---

Pricing

Pay per event. You are charged only for domains that were successfully profiled, and only for the modules you enabled.

Event	Price	When
Actor start	$0.005	Once per run
Domain profiled	$0.0025	Per successful domain — tech stack, tracking IDs, metadata, commerce, hosting, DNS, security headers, pages
Contact enrichment	$0.002	Per domain when contact extraction runs
Intelligence enrichment	$0.0015	Per domain when e-mail infrastructure, GTM expansion or TLS inspection runs

Everything enabled: $6 per 1,000 domains. Technographics only: $2.50 per 1,000.

---

Tips

• Chain it. Point sourceDatasetId at the output of a Google Maps, LinkedIn or directory scraper to enrich those companies in place.
• Schedule it. Re-run a saved list weekly and diff technologyNames to catch platform migrations the week they happen — that is a sales trigger.
• Segment on martechMaturityScore. Low score + e-commerce platform = a company that hasn't bought tooling yet. High score + isSpoofable = a sophisticated buyer with a real problem.
• Use SAN records. With enrichTls on, tls.altNames often reveals every brand and country site a company operates, from a single domain.

---

FAQ

Why did some domains fail? Check errorCode. ENOTFOUND means the domain doesn't resolve, HTTP_403 and BOT_CHALLENGE mean bot protection blocked the request, ETIMEDOUT means the server didn't respond in time. Failed domains are never billed.

Do I need a proxy? Usually not, and it's disabled by default. Datacenter proxies can help if you're profiling many domains on the same host. Residential proxies raise the success rate on heavily protected sites but cost far more than everything else in this Actor combined — enable them only for lists you know are blocking you.

How do I get a clean CSV? Set flattenOutput: true, then export the dataset as CSV. Arrays come through pipe-delimited instead of as JSON blobs.

Can I profile subpages, not just homepages? Yes — pass full URLs. The path is preserved, and tracking parameters are stripped so duplicates still collapse correctly.

How many domains can one run handle? Tens of thousands. Assign more memory and raise maxConcurrency together (~20 per GB). Cost per domain is the same at any size; only wall-clock time changes.

How fresh is the data? Every field is fetched live at run time. Nothing is cached or served from a database.