Find which prospects run Shopify, HubSpot or Microsoft 365, from a list of domains

#python #sales #marketing #automation

A lot of B2B selling starts with "what do they run?". A Shopify app developer wants the stores on Shopify, an agency wants the sites with no ad pixel, an email security vendor wants the companies on Microsoft 365 without a DMARC policy. The answer is sitting in each company's homepage and DNS records; reading it for a few thousand domains by hand is the problem.

This post turns a domain list into a segmented prospect sheet in Python, then compares the tech stack lookup tools on the Apify Store using the prices their Store pages listed at the time of writing.

Disclosure: I'm Aurelix, and I built the Tech Stack API. It's a paid tool (prices below). Check each Store page before you buy: prices change.

What one row tells you

Each domain is read live: its homepage once (robots.txt obeyed) and its public MX, SPF, DMARC and NS records. One row per domain:

One column per category, as a list of names: cms, ecommerce, analytics, tag_manager, advertising (Meta Pixel, Google Ads, LinkedIn, TikTok...), chat, crm_marketing, payments, consent, framework, backend, web_server, cdn_hosting.
Email from DNS: email_provider (Google Workspace, Microsoft 365, Zoho...), email_security (a gateway such as Mimecast or Proofpoint), email_sender (sending services named in SPF), dmarc_policy (none, quarantine or reject), plus the raw mx and spf.
dns_provider, technologies (every detection as name and category), homepage_checked, and a note when the homepage could not be read.

When a site blocks bots, the row still carries the DNS fields, which is often enough to segment by email provider.

From a domain list to segments

pip install apify-client

import csv
import os
from collections import Counter

from apify_client import ApifyClient

DOMAINS = ["allbirds.com", "davidstea.com", "webflow.com", "hubspot.com", "mcgill.ca", "wordpress.org"]

client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("aurelix/tech-stack-detector").call(run_input={"domains": DOMAINS})
rows = list(client.dataset(run["defaultDatasetId"]).iterate_items())

cols = ["domain", "cms", "ecommerce", "analytics", "advertising", "chat", "crm_marketing",
        "email_provider", "email_security", "dmarc_policy", "homepage_checked", "note"]
with open("stacks.csv", "w", newline="", encoding="utf-8") as f:
    w = csv.writer(f)
    w.writerow(cols)
    for r in rows:
        w.writerow(["; ".join(r[c]) if isinstance(r[c], list) else r[c] for c in cols])

shopify = [r["domain"] for r in rows if "Shopify" in r["ecommerce"]]
no_pixel = [r["domain"] for r in rows if r["homepage_checked"] and not r["advertising"]]
weak_dmarc = [r["domain"] for r in rows if r["email_provider"] and r["dmarc_policy"] in (None, "none")]
print("On Shopify:", shopify)
print("No ad pixel on the homepage:", no_pixel)
print("Email provider found, DMARC missing or monitor-only:", weak_dmarc)
print("Email providers:", Counter(r["email_provider"] or "unknown" for r in rows).most_common())

Each segment is a different conversation: Shopify stores for an app or agency, sites with no ad pixel for a paid-ads pitch, a missing or monitor-only DMARC policy for an email security vendor. homepage_checked matters for the second one: an empty advertising list only means "none found" when the homepage was actually read.

Where the domains come from:

Your CRM or a purchased list: paste the domains or full URLs; only the host is used, so https://apify.com/store and APIFY.COM count as one domain.
A local business list: run the Google Maps Phone Scraper for a category and city; its website column is this tool's domains input, and cms then shows who is on Wix, Squarespace or WordPress.

Tech stack lookup tools on the Apify Store compared

Prices per 1,000 domains from each Store page at the time of writing:

	Aurelix Tech Stack API	builtwith/builtwith-official-technology-scraper	automation-lab/wappalyzer-technology-lookup	scrapemint/website-tech-stack-detector
Free plan	$1.50	$2.00	$0.24	$10.00 per site with a detection
Bronze	$1.05	$2.00	$0.21	$10.00
Gold	$1.05	$2.00	$0.13	$10.00
Start fee per run	$0.001	none	$0.005	none
Where the data comes from	live homepage + DNS	BuiltWith's own database	live pages, 1 to 5 per domain	live site
Email provider (MX), SPF senders, DMARC policy	yes	not stated	not stated	not stated
One column per category	yes	not stated	flat list of categories	not stated
Confidence and evidence per detection	no	not stated	yes	not stated
Unreachable domains free	yes	not stated	not stated	yes

Where each wins: automation-lab is far cheaper per domain than any of the others, can read several pages per domain, and gives a confidence score and the evidence behind each match; for bulk enrichment of technology names alone, it's the one to try first. BuiltWith's official tool is the most used and draws on BuiltWith's own database rather than a single live visit. scrapemint charges only for sites where it found something. The Aurelix tool fits when the email side matters as much as the website: mailbox provider, security gateway, SPF senders and DMARC policy from DNS on every row, in flat CRM-ready columns, still filled in when the homepage blocks bots.

Limits

Homepage only, no JavaScript. Tools loaded later by a tag manager, only on inner pages, or only after cookie consent can be missed. Tag managers themselves are detected.
No history. No first-seen dates or spend estimates; each run is a fresh read, and there is no change-only mode.
Rule-based detection from our own fingerprint rules (not Wappalyzer or BuiltWith data); a rare false match or miss is possible, and versions are not reported.
SPF is read one level deep: includes are matched by name, nested includes and redirects are not followed.
Blocked sites get the DNS fields only, with homepage_checked false and a note saying why.
Speed: ten domains at a time, about 40 to 60 a minute; for lists above about 2,500 domains, raise the run timeout.

Cost

You pay per domain analysed. A domain whose homepage is blocked is still charged once, because its row carries the DNS fields; domains that neither resolve nor answer, and duplicates in the input, are free. The current price per domain is on the Store page; Apify's free plan includes $5 of credit a month, enough for a few thousand domains.

DEV Community