Competitive Teardowns

What can you learn from a competitor's infrastructure?

By · July 11, 2026 · 7 min read

A competitor's infrastructure tells you where they host, who runs their email and DNS, how their TLS is configured, and often which AI backend they wired in. These signals expose spend, maturity, migration history, and vendor choices the marketing site hides. Bassethound returns all of it correlated with tech stack and firmographics in one keyless call.

Best move: read the DNS, the certificate, and the response headers before you read the marketing site.

Why it works: engineers pick infrastructure under budget and reliability pressure, and those choices leave a record of scale, vendors, and migrations no landing page admits.

Key takeaways

  • A TLS certificate’s SAN list often names internal subdomains and sibling brands the competitor never links.
  • ASN and hosting org separate a serious platform (dedicated or enterprise cloud) from a shared-host side project.
  • Email provider plus the SPF, DKIM, and DMARC booleans name the vendor and show how much the team invests in deliverability.
  • Nameservers and DNS TXT records expose the SaaS tools bolted onto the domain, since verification tokens leak Google, Atlassian, Zoom, Docusign, and more.
  • Bassethound returns infrastructure correlated with tech stack, AI backend, and firmographics, so one call replaces five OSINT lookups.

What does the TLS certificate tell you that DNS does not?

DNS tells you where a hostname points. The certificate tells you the whole family of hostnames a team decided to protect together. Read the Subject Alternative Names. A cert issued for www.example.com often lists staging.example.com, api.example.com, mail, vpn, or a second brand entirely. Those SANs are internal architecture leaking through a public artifact.

Look at the issuer. Let’s Encrypt with 90-day rotation signals automation and a cost-conscious team. A DigiCert or Entrust OV/EV cert signals procurement, compliance, and budget. The expiry and days_remaining tell you whether renewal runs on a cron or on someone’s memory. A production cert with four days left is an operational tell.

The cert also anchors the security read. TLS grade plus header grade together separate a team that maintains its stack from one that shipped once and walked away. Bassethound returns issuer, SANs, expiry, and days_remaining in the infrastructure layer, and folds the TLS grade into the security summary.

Honest limit: a certificate only names hosts the team chose to bundle. Split certs, per-service certs, and wildcards each hide detail. A wildcard (*.example.com) protects everything and names nothing. Read the cert as one strong signal, not a complete map.

How do hosting org and ASN reveal scale and spend?

The IP resolves to an ASN, and the ASN belongs to an organization. That chain separates a serious platform from a weekend project faster than any homepage copy.

A dedicated ASN or an enterprise cloud account (AWS, GCP, or Azure with a named org) tells you the competitor runs real infrastructure at scale. Budget shared hosting says the opposite. A managed platform (Vercel, Netlify, Cloudflare Pages) points to a team that trades control for developer velocity.

Layer the CDN on top. An enterprise CDN (Cloudflare Enterprise, Akamai, Fastly) in front of origin signals traffic worth protecting and a budget to protect it. No CDN on a production site points to low traffic or an early team.

Nameservers add another read. Route 53 pairs with an AWS shop. Cloudflare nameservers pair with the Cloudflare edge. NS1 or Oracle Dyn points to a team paying for managed DNS traffic steering, which means scale.

None of this prices the contract. You cannot read a monthly bill from an ASN. You get a tier: side project, growing product, or funded platform. That tier is often the single most useful line in a teardown, because it tells you whether you race a team of two or a team of two hundred. Bassethound reports IP, ASN, hosting org, CDN, and nameservers together in the infrastructure layer.

What do email records say about a competitor’s operations?

Email is infrastructure people forget is public. MX records name the provider outright: Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast. That single fact tells you the competitor’s office suite, their likely doc and calendar stack, and often their size, since Proofpoint or Mimecast in front of MX means an enterprise that bought email security.

The SPF, DKIM, and DMARC booleans show how much the team invests in deliverability. All three present with a DMARC policy of reject means someone owns email operations and watches for spoofing. SPF only, no DMARC, means email is an afterthought. That gap is a real operational tell, and sometimes a security one.

DNS TXT records leak the rest of the SaaS stack. Verification tokens sit in TXT for Google, Atlassian, Zoom, Facebook, Docusign, and dozens more. Each token is a tool the competitor pays for and wired into their domain. Read the TXT records and you read a partial vendor list nobody meant to publish.

Together, email records sketch how the competitor operates: which suite, which security vendors, how disciplined the deliverability setup is, and which tools touch the domain. That is organizational intelligence, not a mail config.

Honest limit: a TXT verification token proves someone connected a tool once, not that it runs today. Stale tokens linger for years. Treat them as leads to confirm. Bassethound returns MX, email provider, the auth booleans, and TXT vendors in the infrastructure layer.

Where does an outside look at infrastructure go blind?

Every honest teardown names its blind spots. These are the ones that matter.

A static crawl sees served assets and public records. It does not see fully server-side logic. If a competitor renders everything on the server and calls its AI backend from there, the outside look catches the response, not the call. Reverse proxies compound this. A component behind an origin proxy can hide from the edge.

DNS and certificates are public, but they only show what the team chose to expose. A wildcard cert names nothing. Split-horizon DNS hides internal records from external resolvers. Private ASNs and internal-only services never surface.

JavaScript rendering closes part of the gap. Client-initialized widgets and SDKs appear only after the page runs, so a render pass catches them. Rendering has its own limits. Auth-gated flows, geo-fenced content, and anything behind a login stay dark.

The right move is to treat infrastructure as strong-but-partial evidence. Two correlated signals beat one loud claim. A CDN in the headers plus the CDN’s nameservers plus its cert issuer is a confident read. A single ambiguous header is a lead.

Bassethound renders when the signals call for it, and it reports what it could not reach rather than filling the gap with a guess. The dossier marks its blind spots. That honesty is the point. A teardown that pretends to see everything is the one you cannot trust.

How does infrastructure connect to the rest of the teardown?

Infrastructure alone is a list of vendors. Correlated with the other four layers, it becomes a read on the whole company.

Tie hosting and CDN to the tech stack and you see whether the framework matches the deployment (a Next.js app on Vercel is coherent; a Next.js app on shared PHP hosting is a story). Tie the TLS and header grades together and you get a real security posture, not a checkbox. Match the email provider and TXT vendors against firmographics and you place the company by size, vertical, and the tools that run it.

The highest-value tie is infrastructure to the AI-readiness layer. An enterprise cloud account plus a detected model provider plus a vector store is a competitor shipping real AI. The same AI signals on shared hosting read as a prototype. Infrastructure sets the context that says whether the AI stack is production or experiment.

This correlation is the reason to make one call instead of five. WhoisXML gives you infrastructure OSINT. BuiltWith gives you the tech stack. Apollo gives you firmographics. Stitching them yourself is manual, lossy, and stale the moment you finish. An agent cannot reconstruct that correlation from five separate MCP servers without paying for it in latency and tokens.

Bassethound fuses all five layers into one dossier: primary_stack, ai_readiness, security_grade, and an icp_signal of hot, warm, or cold. Infrastructure is one layer of the read, and its value multiplies against the other four.

Bassethound perspective

Infrastructure OSINT is a crowded, mature market. Censys, Shodan, WhoisXML, and DomainTools all return deep infrastructure data. You do not win by out-crawling them on that one layer. You win by refusing to sell that layer alone.

A competitor’s infrastructure becomes intelligence only when it sits next to the tech stack, the AI backend, the firmographics, and the security grade. An ASN is a fact. An ASN plus a detected model provider plus a funding-stage firmographic is a decision about whether to compete. The single-layer vendors would dispute this. They will tell you corpus depth is the moat. Corpus depth is real, and for one layer they win. But an agent running a teardown does not want five deep single-layer answers it has to reconcile by hand. It wants one correlated dossier it can act on inside a single request.

That is the bet. Fan-out across five MCP servers is expensive and lossy. Fusion in one keyless call is the product. We read the stack, the wires, and the certs together, and we tell you where we went blind.

Sources

Frequently asked questions

Is reading a competitor's infrastructure legal?

Yes. Everything here comes from public DNS records, TLS certificates, HTTP response headers, and served assets. You look at what any browser or resolver already sees. Bassethound is read-only and carries nothing from one call to the next.

Can you tell how much a competitor spends from infrastructure alone?

Not to the dollar. But an enterprise CDN, a dedicated ASN, and multiple email-security vendors signal real budget and scale. Bassethound reports the signals and the tier, not an invoice.

Which infrastructure signals matter most in a teardown?

Hosting org and ASN, CDN, nameservers, email provider, and the TLS certificate. The certificate's SAN list often leaks internal subdomains and sibling properties the competitor never links publicly.

Does a static crawl miss anything?

Yes. Fully server-side or reverse-proxied components hide from an outside look, and auth-gated flows stay dark. Bassethound renders when signals call for it and reports what it could not reach instead of guessing.

How is this different from WhoisXML or Censys?

Those return one deep layer of infrastructure OSINT. Bassethound correlates infrastructure with the tech stack, AI backend, firmographics, and a security grade in a single call, so an agent gets a whole read instead of one layer.

Keep reading

Sniff a domain.

Run sniff_domain on any site and read its five-layer dossier in one call.

Sniff a domain