loading
Loading content
loading
Recon
Find related domains and subdomains via shared Google Analytics IDs.
overview
analyticsrelationships reads a target's page, pulls the Universal Analytics tracking ID out of the source, and asks a reverse-analytics index which other domains report that same ID. Because organizations wire one Analytics property into many of their sites, that shared ID exposes sibling domains and subdomains that carry no DNS or certificate link back to the parent.
This is a pivot through a shared identifier, not name brute forcing. It surfaces properties a subdomain enumerator would never reach, since the connection is a tracking code rather than a naming pattern. Chain mode strips the banner and status lines so the output is a plain list of hostnames you can merge straight back into scope.
On Trickest, analyticsrelationships is a Recon node that takes a file of URLs and writes a file and a folder of related hosts. Run it during scope expansion next to subdomain discovery, then send the domains it finds into the same probing and enumeration stages as the rest of your targets.
use cases
Extract a target's Google Analytics ID and find other domains reporting the same ID, surfacing siblings that share ownership but not DNS lineage.
Reach related domains that subdomain enumeration cannot find because the link between them is a shared tracking identifier, not a name pattern.
After a merger or rebrand, an old Analytics ID often lingers across legacy properties, tying together domains that live on different registrars and hosts.
Run with -ch to emit clean hostnames, merge them into the target list, and let probing and subdomain discovery cover the wider footprint.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls | FILE | · | File of URLs to scan for Google Analytics IDs (one per line). |
| chain-mode | BOOLEAN | -ch | Output only the related hostnames with no banner or status lines, ready for chaining. |
Showing key inputs. analyticsrelationships exposes 2 inputs in total.
example
# urls.txt holds target URLs, one per line (e.g. https://example.com)analyticsrelationships < urls.txt[+] Testing: https://example.com[+] Analytics ID found: UA-41528837-2[+] Related domains and subdomains: example.org shop.example.net blog.example.com careers.example.com [+] 4 related hosts foundguidance
Use analyticsrelationships during scope expansion when you want to find an organization's related properties through shared Google Analytics IDs, a link that name-based discovery cannot follow. It finds related domains, so feed them into your probing and enumeration stages.
Finds related domains via reverse whois, ASN, and CIDR. A different pivot than the Analytics-ID link.
Enumerates subdomains of a known domain. analyticsrelationships finds sibling domains across ownership instead.
Correlates assets by favicon hash. Another identifier-based pivot to run alongside this one.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find domains and subdomains potentially related to a given domain.
OSINT automation for hackers.
A list of URLs feeds analyticsrelationships, which finds domains sharing the same Analytics ID and passes them to httpx so live related hosts land as output.
Facts on this page come from the live Trickest tool library.