Reverse Analytics Lookup: Connecting Domains Through Shared Tags

Why I use a reverse lookup

A reverse analytics lookup starts with an analytics identifier or tag and searches an index for domains where it has been observed. I use it to find leads when reviewing an organization's public footprint or investigating related infrastructure.

The useful connection is that two pages share a marker. Ownership is a separate question. Agencies, shared templates, copied source, and old deployments can produce the same connection without establishing a single current owner.

My original post said these tools could identify all associated websites. That was too broad. A result is limited by the provider's collection method, history, and available index.

What I search for

DNSlytics Reverse Analytics / Google Tag accepts a domain or supported tag identifier. Its current documentation lists several Google identifier families, including legacy UA- identifiers, G- identifiers, and Google Tag Manager containers.

The provider also explains that it collects identifiers from domain homepages. That matters: an identifier present only on a deeper page may not appear in this index. I check the provider's collection notes before interpreting a missing result.

The original example searched for ua-15589237. I retain that as a historical query, not a fresh ownership finding.

Historical search term: ua-15589237

The old result text said it found two domains, but the excerpt showed only one domain row. I do not silently fill in the missing domain or reuse the old counts as current data.

Account for the move beyond Universal Analytics

A UA- identifier can still be a useful historical marker in source code or archived data. It does not prove that Universal Analytics is currently collecting events.

Google retired Universal Analytics, with the final shutdown of its interface and APIs beginning in July 2024. I use Google's sunset notice when interpreting the age of an identifier.

For a current investigation, I inspect what the page actually loads. I do not assume that an old UA- query covers modern Google tags or that every identifier family has identical collection semantics.

A lookup I can defend

My workflow is deliberately small:

1. Record where I observed the identifier and when I saw it.
2. Search the provider using the exact identifier or documented query format.
3. Save the result and its observation dates.
4. Check whether the identifier is still present on each relevant page.
5. Look for independent evidence supporting the relationship.

Independent evidence might include matching organizational details, a documented redirect, or a relationship confirmed by the site owner. Shared hosting or a common nameserver can be weak evidence because many unrelated sites use the same service.

I also distinguish when I ran the search from when the provider observed the tag. A result viewed today can describe a page collected much earlier.

Common reasons to be cautious

I keep provider coverage and account restrictions in mind. A limited result view is not the same as a complete dataset, and a missing row is not evidence that a domain does not exist.

Turn the lead into a useful note

For attack-surface work, a newly associated domain goes into a review queue. I confirm ownership and assessment scope before any active testing. For an investigation, I keep the original observation and separate it from my interpretation.

The final note should say what I observed: the identifier, source page, collection date, returned domains, and supporting evidence. If ownership remains uncertain, I say so. The lookup is most useful when it narrows the next question without pretending to answer every question at once.