Technology Lookup – Website Tech Stack & Companies Using X

Website technology checker with active-use verification, plus a reverse mode that finds the companies using a technology. Give it websites and get each one's tech stack — CMS, ecommerce platform, analytics, tag manager, ad pixels, CRM, marketing automation, live chat, help desk, payments, hosting, CDN, email provider and email marketing stack, and the SaaS the company is a verified customer of — with evidence next to every technology and an activeVerified flag that says whether the tool is actually running, not just mentioned. Give it a technology too, and the run returns only the companies confirmed using it.

If you sell into a stack, technographics are the sharpest targeting signal there is: a Drift customer is an Intercom prospect, a Shopify Plus store is a Klaviyo/Gorgias/Recharge prospect, a company on HubSpot with no ABM tag is a 6sense prospect. The problem with the usual tech-stack lookups is false positives — a tag that is present in the HTML is not a tool that is in use: half the "detections" are leftover snippets, deleted containers and dead pixels, and a sequence built on them burns replies. This Actor fetches the live resource for each detection and tells you which ones are real.

Website tech stack lookup (forward mode)

One row per website, with the stack that matters for outreach as flat, sortable columns and the full list underneath:

Field	What it tells you
cms, websiteBuilder, ecommerce, ecommerceApps	What the site runs on — WordPress, Shopify, Webflow, HubSpot CMS, Magento, BigCommerce… and the apps around it
crm, marketingAutomation, emailMarketing, abm, cdp	The revenue stack: HubSpot, Salesforce, Marketo, Pardot, Klaviyo, Mailchimp, 6sense, Demandbase, ZoomInfo, Clearbit, RB2B, Segment…
chat, support, scheduling, forms	Intercom, Drift, Zendesk, Gorgias, Crisp, Calendly, Chili Piper, Typeform…
analytics, sessionReplay, tagManagers, advertising, abTesting	GA4, Mixpanel, Amplitude, Hotjar, Clarity, GTM, Tealium, Meta/LinkedIn/TikTok pixels, Optimizely, VWO…
payments, subscriptions	Stripe, PayPal, Adyen, Klarna, Shop Pay, Chargebee, Recharge…
hosting, cdn, dnsProvider, security, frameworks	Vercel, Netlify, AWS, Cloudflare, Akamai, WP Engine, Next.js, React…
emailProvider	Google Workspace, Microsoft 365, Mimecast, Proofpoint… (who runs their mail)
saasVerified	SaaS the company is a verified customer of — Rippling, Atlassian, Zapier, KnowBe4, Miro, DocuSign, OpenAI, Anthropic, Cursor, Okta…
technologies[]	Every technology with category, confidence (0–100), activeVerified, verification method, evidence[], version and vendor-side ids, plus firstSeen / lastSeen
addedSinceLastCheck, removedSinceLastCheck, previousCheckAt	What changed since your previous run — the switch-play trigger
gtmContainers, dns	The tag containers read and the DNS facts used

The Tech stacks dataset view is the one-line-per-website table; All technologies shows the evidence; Changes since last check shows what moved.

Active-use verification: how "really running" is decided

Every technology carries a verification method, and activeVerified is true only when something live confirmed it:

verification	Meaning
id-validated	The vendor served the resource for this site's own id (tag container, CRM portal, chat app, heatmap site, CDP write key…). A deleted id returns 404 and the technology is downgraded with a note.
endpoint-live	A platform endpoint on the site answered (a storefront product feed, a CMS API index).
script-served	The vendor script the page references was fetched and served as JavaScript.
gtm-container	The tag is configured inside the site's live tag-manager container — tools loaded through Google Tag Manager never appear in the HTML, and most lookups miss them.
dns-live, header-live, cookie-live	A DNS record, a response header or a cookie from the live server named the vendor.
none	Pattern-only (a meta generator, an inline snippet). Reported, with lower confidence, but not verified.

The result is a stack you can act on: a "Drift" whose script no longer loads is reported as not verified, a chat tool that only exists inside the tag container is still found.

Companies using X (reverse mode)

Enter a technology — a name or a vendor domain (HubSpot, Shopify, Intercom, Marketo, lemlist.com) — together with a list of websites, and the run returns only the ones confirmed using it: usesTechnology, matchActiveVerified and matchEvidence[] per company, with the rest of the stack alongside. Technologies that imply the one you asked for count too (a WooCommerce store uses WordPress). Names outside the built-in catalog still work: they are matched as a marker in script hosts, DNS records and tag containers.

No website list yet? Give discovery queries (marketing agency, dental clinic) and a location, and the run first discovers companies by business search and then checks each one — the Companies using the technology view is your list. Websites that do not use the technology are checked for free.

Changes between runs (the switch-play trigger)

With Track changes on (default), each website's stack is remembered in a named key-value store on your account. Every later run reports firstSeen / lastSeen per technology and addedSinceLastCheck / removedSinceLastCheck per website. Put a target-account list on a weekly Schedule and the Changes since last check view becomes a feed of "just added Intercom", "just dropped Drift", "moved to Shopify" — the moments a switch conversation is welcome.

Who uses it

• Outbound / GTM teams — competitor-displacement lists ("every company using X"), stack-based segmentation, and change triggers.
• Agencies — audit a prospect's stack before the first call; find every store on a platform in a market.
• Sales-intelligence & data teams — a technographic column set to join to CRM and enrichment data, with confidence and evidence instead of a black box.
• Product & partnership teams — install bases of complementary tools, adoption of a category over time.
• AI agents — a keyword-discoverable, MCP-callable tool that runs unattended and returns a clean, typed dataset.

Set it up in a minute

1. Websites — one per line (domains or URLs). Agents may also pass urls, websites, startUrls or a comma-separated url.
2. Optionally enter a technology for reverse mode, or discovery queries + location to build the list automatically.
3. Start. Re-run (or schedule) to get change signals.

Advanced settings (collapsed) control verification depth, tag-container reading, DNS, change tracking, category filters, concurrency, timeouts and proxy. The defaults are tuned for unattended runs.

Use it from an agent or the API

The Actor is designed for tool calls: minimal required input, bounded runtime, a typed dataset and no UI to click through.

{ "domains": ["acme.com", "globex.com"] }

{ "technology": "Drift", "domains": ["acme.com", "globex.com", "initech.com"] }

{ "technology": "Shopify", "discoverQueries": ["skincare brand"], "discoverLocation": "United States", "maxDomains": 300 }

Results are in the default dataset (?view=overview, ?view=technologies, ?view=matches, ?view=changes); a run summary with the most common technologies and the full technology catalog by category is in the OUTPUT record of the run's key-value store. Through the Apify MCP server, call inovaflow/technology-lookup with the same input.

Output example

{
  "domain": "allbirds.com",
  "status": "ok",
  "ecommerce": ["Shopify"],
  "payments": ["Shop Pay"],
  "tagManagers": ["Google Tag Manager"],
  "advertising": ["Meta Pixel", "TikTok Pixel", "Criteo", "Microsoft Advertising (UET)"],
  "reviews": ["Yotpo"],
  "emailProvider": ["Microsoft 365"],
  "saasVerified": ["Rippling", "Miro", "DocuSign", "Cursor", "Apple Business Manager"],
  "cdn": ["Cloudflare"],
  "technologies": [
    { "name": "Shopify", "category": "ecommerce", "confidence": 100, "activeVerified": true, "verification": "endpoint-live",
      "evidence": ["script: https://cdn.shopify.com/…", "cookie: _shopify_essential", "dns: www CNAME shops.myshopify.com", "verified: GET /products.json?limit=1 → 200 JSON"] },
    { "name": "Google Tag Manager", "category": "tagManagers", "confidence": 100, "activeVerified": true, "verification": "id-validated", "ids": ["GTM-TH8KRSBJ"],
      "evidence": ["html: …gtm.js?id=…", "verified: https://www.googletagmanager.com/gtm.js?id=GTM-TH8KRSBJ → 200 (629 KB)"] },
    { "name": "TikTok Pixel", "category": "advertising", "confidence": 85, "activeVerified": true, "verification": "gtm-container", "viaGtm": true,
      "evidence": ["gtm: tag in live container GTM-TH8KRSBJ (analytics.tiktok.com)"] },
    { "name": "Rippling", "category": "saasVerified", "confidence": 100, "activeVerified": true, "verification": "dns-live",
      "evidence": ["dns: TXT rippling-domain-verification"] }
  ],
  "techCount": 22,
  "activeVerifiedCount": 20,
  "addedSinceLastCheck": [],
  "removedSinceLastCheck": [],
  "checkedAt": "2026-09-10T13:05:11.000Z"
}

Pricing

Pay per result: a small fee per website analyzed in forward mode, and per company confirmed in reverse mode (websites that do not use the technology, and websites that could not be reached, are free). A run start fee applies per gigabyte of memory. There are no subscriptions and no minimums; typical cost is a few cents per website and well under the usual per-lookup APIs.

Coverage and limits

• Several hundred technologies across 30+ categories, curated for sales and marketing relevance, with verification logic per technology. Custom vendor names are supported in reverse mode as markers.
• Detection reads the page, its response headers and cookies, the live tag-manager container(s) and DNS. No login and no browser are required; JavaScript-rendered single-page apps still expose their tags through the container, headers and DNS.
• A website that blocks automated access or is offline is reported with status: unreachable / blocked and is not charged.
• Only public information is used: the website's own pages and its public DNS records.

FAQ

How is this different from other tech-stack detectors? Three things: every technology is verified live (with the evidence shown) rather than pattern-matched; tools loaded through the tag manager are found; and DNS is read — email provider, email marketing stack, hosting and SaaS the company is a verified customer of — which no page-only detector sees. Plus a reverse "companies using X" mode.

Can I look for a technology you do not list? Yes. Enter its name or vendor domain; it is matched as a marker in script hosts, DNS records and tag containers, with evidence.

Does it work on single-page apps? Yes. Headers, cookies, DNS and the tag container do not depend on client-side rendering; tags injected only by JavaScript at runtime without a tag manager may be missed.

How fast is it? Around one to three seconds per website; a 1,000-website list typically finishes in a few minutes.

Is a proxy needed? Not usually. The default configuration uses a datacenter proxy and falls back to a direct request automatically.