From analytics to pipeline: qualifying the companies that visit your site

Run a BizDev service for a while and the math gets uncomfortable. Each customer’s visitor-identification tool emits a weekly report of company domains. Multiply by a book of customers and you are processing hundreds, maybe thousands, of domains a month. Every row becomes a CRM record, a Slack alert, a rep’s research hour. And nobody checks whether the domain on the row is a real company, the right legal entity, or a shell that cannot even receive email.

We simulated one of those weekly reports and ran the whole thing through the WhoisGenius API. Fifty domains, one batch call. This post is the full result set, what the evidence looks like per row, and how to wire the qualification layer into the deliverable you hand your customers.

Keep your visitor tool

This layer does not replace visitor identification. It sits after it.

The identification vendors (Leadfeeder, Snitcher, Albacross, Clearbit, RB2B, Warmly) solve a real problem and are honest about its ceiling. Warmly publishes its own production match rates: 30-65% of visits resolve to a company, 5-20% to a person. Snitcher’s docs state that consumer ISPs, VPNs, and mobile carrier IPs leave visitors anonymous at the company level. When someone browses from home on a residential connection, no company domain exists to recover, and no qualification layer can help with a name that was never produced.

What the identification step produces, when it works, is a name and a domain. What none of the ten vendors’ documented output includes is any verification of that domain: not its legitimacy, not its age, not its mail configuration. Corporate hierarchy data does exist in this market, as separate enrichment products (Clearbit parent/child attributes, ZoomInfo and D&B family trees). Those are databases refreshed on a vendor’s schedule. They do not check whether the domain that visited you is operated, today, by the entity the database names. The domain itself knows.

The run: fifty rows, one batch call

We built a plausible weekly report for a B2B SaaS: thirty-seven real companies of varying size, plus a dozen rows of the junk that real visitor lists accumulate. One POST /analyze/batch call. The fleet autoscaled from 2 to 6 workers during the run; the whole batch finished in eleven minutes.

The full result set, exactly as returned:

Verdict	Rows	Domains
confirmed	8	amplitude.com, plaid.com, rippling.com, zendesk.com, gong.io, clerk.dev, digitalocean.com, planetscale.com
likely	12	canva.com, cloudflare.com, greenhouse.io, hashicorp.com, klaviyo.com, monday.com, mongodb.com, neon.tech, netlify.com, remote.com, resend.com, sentinelone.com
possible — real	10	asana.com, braze.com, datadog.com, deel.com, elastic.co, hubspot.com, lattice.com, lever.co, linear.app, paloaltonetworks.com
possible — junk	10	drovenpex.com, duverainvion.cz, eirevaltrex.org, givirtrinxes.com, grendoralyxis.com, kapitfonpro.com, kitarenix.org, kydonarex.com, nethertoxagent.com, spitecho.top
inconclusive	3	posthog.com, ramp.com, supabase.com
unattributable	2	exolventra.info, finavorixpro-app.com — both junk
failed, refunded	4	brex.com, crowdstrike.com, okta.com, vercel.com

Two things to notice. First, twenty real companies resolved to their exact legal entity, several through evidence that is impossible to fake cheaply: a registrant record, the copyright holder on the site, account-scoped analytics IDs. Second, the verdict tiers alone do not separate junk from real. Both live in possible. What separates them is the rest of the row.

The evidence is the filter

Line up the twelve junk rows against the thirty-seven real ones and the pattern is not subtle:

• Mail. Every one of the thirty-three real companies with a completed analysis runs authenticated corporate email: Google Workspace or Microsoft 365, often fronted by Proofpoint, DMARC enforced. Eleven of twelve junk rows have no MX record at all. No SPF, no DMARC. These “companies” cannot receive the outreach your sequence would send them.
• Age. The real companies’ domains are thousands of days old (plaid.com: 11,329; lattice.com: 10,907). The junk rows cluster at 268 to 402 days. A real prospect with a nine-month-old domain exists, but stacked next to no mail and a self-named operator, the picture is complete.
• Self-naming. Every junk row’s candidate operator is the domain’s own name, backed by the site’s self-description and nothing else. Scoring deliberately treats the name as weak evidence, because registering a lookalike costs ten dollars. That is why none of them climbed past possible.

So the routing rule a service should apply is not the verdict alone. It is the combination: verdict plus email_intelligence plus freshness.age_days. Real and routable rows have all three pointing the same direction. The junk rows fail all three at once, every time.

The acquisition problem, solved by accident

Here is the row that justifies the layer on its own. Your report says neon.tech visited. Fine, a database startup, maybe a fit. The analysis says otherwise:

• neon.tech resolves to operator Databricks Inc. (Databricks acquired Neon)
• hashicorp.com resolves to International Business Machines Corporation (IBM acquired HashiCorp)
• lever.co resolves to Employ Inc. (Lever’s parent)
• segment.com resolves to Twilio Inc., confirmed by the registrant record and two shared analytics account IDs on the page
• figma.com returns parent_company: "Adobe"

None of these are lookups in a hierarchy database. They come from the domain’s own current evidence: who the registry says operates it, which analytics accounts its pages load, which legal entity its own footer names. A rep working “Neon” without the parent is pitching into the wrong org chart, and territory rules keyed on the brand name route the account to the wrong owner. Four rows like that appeared in one fifty-row list.

For a BizDev service this is the deliverable upgrade: not “these fifty companies visited,” but “these fifty rows are really forty-one accounts, four of them roll up to enterprises you already track, and here is the evidence for each.”

What a row looks like

The headline fields, from the real response for segment.com:

"attribution": {
  "verdict": "confirmed",
  "operator": "Twilio Inc.",
  "ownership_signals": 2,
  "corroborating_correlations": 3,
  "dominance": 2.5,
  "rationale": "2 independent ownership signal types and 3 cross-signal
    correlations name Twilio Inc.; the nearest alternative is 2.5x weaker."
}

The per-signal endpoint (GET /jobs/{id}/signals) shows the working: the registration record names Twilio Inc. (contribution 0.229), the site’s copyright holder names Twilio Inc (0.135), and two account-scoped analytics IDs (G-RRP8K4M4F3, GTM-5JLZ694) sit on the page because someone with access to Twilio’s accounts put them there. The losing candidate, “Segment,” is backed by exactly one signal: the domain name itself, contribution 0.048.

Every row carries its rationale like this, which matters more than it looks. When your customer asks “why is this company on my call list,” the answer is a sentence they can forward to their boss, not a shrug.

The mechanics at scale

The integration is deliberately boring:

• Throughput: the fifty-domain run finished in eleven minutes, with the worker fleet autoscaling on queue depth to its 6-task ceiling during the run. A thousand domains a week is a background job, not a project.
• Cost: one credit per domain, $0.15-0.28 at pack prices. Fifty rows cost about ten dollars. A thousand a month costs less than one rep-hour.
• Delivery: analyses are async with signed webhooks (callback_url, HMAC-SHA256, retried), so the layer drops into an event-driven pipeline without polling.
• Agent workflows: an MCP server at https://api.whoisgeni.us/mcp exposes analyze_domain and correlate_domains, so an AI SDR can qualify a domain mid-task in seconds.
• Account consolidation: /correlate clusters 2-100 domains by shared operator, so a report showing segment.com and twilio.com becomes one account with multiple entry points.

The hard questions

“What about visitors from home?” Nothing to qualify. If identification produces no domain, there is nothing to check. We qualify names; we do not conjure them.

“Do you ever fail on a real company?” Yes, and we say so. When a site’s edge protection blocks the evidence collectors, the verdict is unattributable with content_protected: true, which routes to a human, not the trash. A qualification layer that guesses is worse than none, because it manufactures the confidence you were trying to buy. In the run above, four of forty-nine analyses also hit the wall-clock analysis budget under the burst; those jobs failed fast and were refunded automatically, which is what should happen to a job that cannot deliver.

“Why not just buy hierarchy data from ZoomInfo or D&B?” Different object. Those databases tell you the family tree as of their last refresh. This reads the domain as it exists today: who operates it right now, whether the mail works, whether it is twenty-seven years old or three hundred days old.

Keeping it honest

1. A verdict is not a probability. confirmed means the evidence structure is strong: independent ownership signals, corroboration, no serious rival. Confidence values rank candidates; they are not likelihoods.
2. The deep reads are conditional. Screenshot-vision analysis and LLM enrichment fire when evidence is ambiguous, not on every domain. When enrichment_pending is true, re-fetch in a bit.
3. Absence cuts both ways. Our vendor claim is that none of the ten we reviewed document domain-level verification in their identification output; absence claims are only as strong as the reading. The match rates cited are the vendors’ own published numbers, not independent audits. And our junk filtering leans on the same logic in reverse: a domain with no ownership evidence anywhere is a finding, not a coverage gap.

Your visitor reports already tell you that companies visited. The qualification pass turns that into the thing your customers actually renew for: a report where every row carries its evidence, where “why is this company on my call list?” has an answer they can forward to their boss, and where the junk never bills a rep-hour. You stop selling a list of names and start selling a vetted pipeline.

---

The evaluation takes one call. Export last week’s visitor report, paste the domains:

curl -X POST https://api.whoisgeni.us/analyze/batch \
  -H "X-API-Key: wg_..." \
  -H "Content-Type: application/json" \
  -d '{"domains": ["first-row-from-your-report.com", "second-row.com"]}'

Fifty rows come back in about eleven minutes, one credit each, and the free tier covers 75. The rows that return a parent company get routed to the right account owner; the rows that return no mail, no history, and no operator get deleted before they cost anyone an hour. Get an API key and run your own list — next Monday’s deliverable is the pitch.