Recon
Correlate sibling properties from shared UA IDs
Find related domains via shared Google Analytics IDs.
overview
What analyticsrelationships does
Run analyticsrelationships when DNS and cert lineage miss sibling brands. It pulls a UA- ID from each URL in the file, then looks up other hosts reporting that ID.
This is an identifier pivot, not brute force. Enable -ch so output is hostnames only, then merge into scope for probing and subdomain enum.
Trickest hosts it as a managed Recon node: FILE of URLs in, FILE and FOLDER of related hosts out. Pair with amass-intel or favfreak for other ownership pivots.
use cases
Where analyticsrelationships fits
Pivot from one site to sibling properties
Extract a target's Google Analytics ID and find other domains reporting the same ID, surfacing siblings that share ownership but not DNS lineage.
Expand scope past DNS-discoverable assets
Reach related domains that subdomain enumeration cannot find because the link between them is a shared tracking identifier, not a name pattern.
Map an acquisition's spread-out footprint
After a merger or rebrand, an old Analytics ID often lingers across legacy properties, tying together domains that live on different registrars and hosts.
Feed discovered domains into enumeration
Run with -ch to emit clean hostnames, merge them into the target list, and let probing and subdomain discovery cover the wider footprint.
reference
analyticsrelationships inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| urls | FILE | · | File of URLs to scan for Google Analytics IDs (one per line). |
| chain-mode | BOOLEAN | -ch | Output only the related hostnames with no banner or status lines, ready for chaining. |
Showing key inputs. analyticsrelationships exposes 2 inputs in total.
example
Run analyticsrelationships
# urls.txt holds target URLs, one per line (e.g. https://example.com)analyticsrelationships < urls.txt[+] Testing: https://example.com[+] Analytics ID found: UA-41528837-2[+] Related domains and subdomains: example.org shop.example.net blog.example.com careers.example.com [+] 4 related hosts foundguidance
Choosing analyticsrelationships
Use analyticsrelationships during scope expansion when you want related properties through shared Google Analytics IDs, a link name-based discovery cannot follow. Feed findings into probing and enumeration stages.
amass-intel
Finds related domains via reverse whois, ASN, and CIDR. A different pivot than the Analytics-ID link.
subfinder
Enumerates subdomains of a known domain. analyticsrelationships finds sibling domains across ownership instead.
favfreak
Correlates assets by favicon hash. Another identifier-based pivot to run alongside this one.
faq
analyticsrelationships questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run analyticsrelationships yourself
A list of URLs feeds analyticsrelationships, which finds domains sharing the same Analytics ID and passes them to httpx so live related hosts land as output.
Facts on this page come from the live Trickest tool library.