loading
Loading content
loading
Recon
Find related domains via shared Google Analytics IDs.
overview
Run analyticsrelationships when DNS and cert lineage miss sibling brands. It pulls a UA- ID from each URL in the file, then looks up other hosts reporting that ID.
This is an identifier pivot, not brute force. Enable -ch so output is hostnames only, then merge into scope for probing and subdomain enum.
Trickest hosts it as a managed Recon node: FILE of URLs in, FILE and FOLDER of related hosts out. Pair with amass-intel or favfreak for other ownership pivots.
use cases
Extract a target's Google Analytics ID and find other domains reporting the same ID, surfacing siblings that share ownership but not DNS lineage.
Reach related domains that subdomain enumeration cannot find because the link between them is a shared tracking identifier, not a name pattern.
After a merger or rebrand, an old Analytics ID often lingers across legacy properties, tying together domains that live on different registrars and hosts.
Run with -ch to emit clean hostnames, merge them into the target list, and let probing and subdomain discovery cover the wider footprint.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls | FILE | · | File of URLs to scan for Google Analytics IDs (one per line). |
| chain-mode | BOOLEAN | -ch | Output only the related hostnames with no banner or status lines, ready for chaining. |
Showing key inputs. analyticsrelationships exposes 2 inputs in total.
example
# urls.txt holds target URLs, one per line (e.g. https://example.com)analyticsrelationships < urls.txt[+] Testing: https://example.com[+] Analytics ID found: UA-41528837-2[+] Related domains and subdomains: example.org shop.example.net blog.example.com careers.example.com [+] 4 related hosts foundguidance
Use analyticsrelationships during scope expansion when you want related properties through shared Google Analytics IDs, a link name-based discovery cannot follow. Feed findings into probing and enumeration stages.
Finds related domains via reverse whois, ASN, and CIDR. A different pivot than the Analytics-ID link.
Enumerates subdomains of a known domain. analyticsrelationships finds sibling domains across ownership instead.
Correlates assets by favicon hash. Another identifier-based pivot to run alongside this one.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A list of URLs feeds analyticsrelationships, which finds domains sharing the same Analytics ID and passes them to httpx so live related hosts land as output.
Facts on this page come from the live Trickest tool library.