How do you profile a company as a sales prospect?

Best move: profile from the domain, and score buying-readiness from the backend, not the pitch on the homepage.

Why it works: a domain exposes firmographics, the live tech stack, and AI signals in one crawl. You read fit and timing from the same pull, and neither needs the prospect to fill in a form.

Key takeaways

• Prospect profiling is fit plus timing: who the company is (firmographics) and whether they buy now (stack and AI signals).
• A domain carries the profile already. Tech stack, infrastructure, and firmographics are public and readable without permission.
• AI-readiness is the timing signal most enrichment tools miss. A company shipping AI has budget and urgency a homepage headline cannot prove.
• Fusion beats fan-out: correlating five layers in one call tells you more than five separate lookups you stitch together yourself.
• Bassethound returns firmographics, stack, AI-readiness, security, and a hot/warm/cold icp_signal in a single keyless call.

What makes a prospect profile actionable?

Two things: fit and timing. Fit answers whether the company matches your ICP. Vertical, size, tech maturity, region. Timing answers whether they are ready to buy now. A profile that gives you only fit leaves you guessing on when to reach out, and a list of matching accounts with no timing signal is a cold-call queue.

A domain carries both. Firmographics give you fit: company name, vertical, description, contacts, social profiles, and structured data lifted from the page. The live stack gives you timing. A company that just added a payments provider, a new analytics platform, or an AI SDK is spending and moving. Correlate the two and a name becomes a reason to call this week instead of next quarter.

The trap is stopping at fit. Most enrichment sells you a firmographic record and calls it a profile. That names who to talk to and says nothing about when. Read the stack and you get the second half for free, because deploying infrastructure is an act, not a claim. Bassethound fuses both halves and returns a single icp_signal (hot, warm, cold), so you get a pre-scored profile instead of raw fields to weigh yourself.

Which signals separate a hot prospect from a cold one?

Modernity and momentum. A cold prospect runs a static brochure site: a CMS, a tag manager, an analytics pixel, nothing that implies engineering spend. A hot prospect ships. You see an AI SDK loaded, a vector store client, an LLM observability tool, an MCP endpoint, or an llms.txt file that classifies as a real standard rather than a stray text file. Each is a distinct signal group, and Bassethound counts them into an ai_readiness score out of six with a verdict: shipping, experimenting, or none.

AI-readiness is the sharpest of these because almost no enrichment tool reads it. Apollo and ZoomInfo will tell you headcount and funding. They will not tell you the company wired up Anthropic’s SDK and Pinecone last month. That backend fingerprint is the timing signal. No one wires a vector store client into their app to look good in a demo, so it means what it says.

Read the other layers for context. TLS expiry and email-auth booleans (SPF, DKIM, DMARC) show operational maturity, and a security header grade of A versus F shows whether the team invests past the minimum. Payments and ecommerce detections confirm they transact online. None of these alone is a verdict. Stacked and correlated, they sort a raw domain list into who to call first, and a shipping verdict on a modern stack is your hot lane.

How is domain profiling different from Apollo or ZoomInfo?

Corpus versus crawl. Apollo, ZoomInfo, and Clearbit sell you a database. Their moat is coverage: millions of pre-collected records, refreshed on their schedule. That is useful for contact data, org charts, and email addresses, and it is where those tools win. But a database is a snapshot, and a snapshot ages. The current-tech-stack field in a firmographic record is often months stale.

Domain profiling reads the site itself rather than a licensed corpus, so what you get comes off the wire instead of a vendor’s refresh schedule. The tradeoff is honest: a crawl sees what the domain exposes and does not hold a private corpus of buyer intent or verified direct-dial numbers. These are different tools for different halves of the job.

The other difference is depth on one axis. Firmographic vendors treat tech and AI as shallow tags if they carry them at all. BuiltWith and Wappalyzer go deep on tech-stack detection but flat on firmographics and AI. Bassethound reads five layers in one call and correlates them, so the AI-readiness verdict sits next to the vertical sits next to the security grade. Five separate lookups will not hand an agent that correlation without paying for each and joining them yourself. Use a firmographic corpus for who to email. Use domain profiling for whether they are worth emailing now.

Can you profile a prospect without asking for their data?

Yes. Everything in the profile is already public. A domain publishes its DNS, its TLS certificate, its response headers, its loaded scripts, and often structured data describing the company. Reading them needs no key from the prospect, no form fill, no account, and no permission, because you are reading what a browser reads.

Bassethound’s free tier is keyless by design. You do not bring your own API key, because the value is in the crawl, not in access you supply. We rate-limit on the free tier. Higher depth and volume run through OAuth on the paid tier. Every call is stateless and read-only: it carries nothing from one request to the next, and the dossier it returns is stored against your account rather than assembled into a profile we resell.

That shapes how you operate. You can score a list of five hundred domains without provisioning credentials for each, and you can run it from inside an agent host (Claude, Cursor, ChatGPT) as one MCP tool call. The profiling happens inside a single request. The agent asks once and gets the correlated dossier back, rather than fanning out to five services and stitching the answers. The limit worth naming: read-only means you observe, you do not verify with the company. You get evidence and a confidence score, and you decide.

What can domain profiling miss?

Anything the domain does not expose to a crawl. This is the honest limit, and the dossier reports the gaps rather than papering over them.

A static crawl reads server-rendered HTML and response metadata. A component that only initializes in the browser needs a JavaScript render, and Bassethound renders when the signals call for it. But fully server-side logic leaves no client trail. If a company calls Anthropic’s API from its backend and never ships a client SDK, the crawl cannot see it, and the profile says so instead of guessing.

Proxied and white-labeled infrastructure hides too. A model provider reached through a gateway, a vector store behind an internal service, a CDN that masks the origin. These flatten a real signal to nothing. Reverse proxies and heavy edge rewriting are the usual culprits.

Firmographics depend on what the site publishes. A company with rich structured data returns a clean profile. A single-page site with no schema markup and a logo gives you thin firmographics, and no crawl invents the missing fields.

So read the profile as evidence, not as a verdict handed down. A none AI-readiness verdict means no signal found on the surface we can read, not this company does no AI. The value is that the gaps carry labels. You know what you know, you know what you could not reach, and you weight the lead on both.

Bassethound perspective

The sharpest prospect-timing signal is not intent data. It is the deployed backend stack. Any firmographic vendor whose revenue rides on intent scores will dispute that. Intent vendors sell a probabilistic guess that someone at an account researched a topic, inferred and aggregated, often wrong about which company and which person. A deployed AI SDK is not a guess. The team wrote the integration, shipped it, and pays for the tokens. That is a fact on the wire.

Most prospecting stacks invert this. They spend on corpora and intent scores and treat the live technical stack as a nice-to-have tag. We think that is backward for the accounts worth chasing now. The companies to call this quarter are the ones building, and building leaves a trail in the front end that survives minification.

The moat is not any single layer. BuiltWith reads tech. Apollo reads firmographics. Censys reads infrastructure. Bassethound reads all five and correlates them in one keyless call, so the AI verdict sits beside the vertical beside the security grade. An agent cannot rebuild that from five separate MCPs without paying five times and joining the results by hand. Fusion is the product. Sniff the stack, score the fit, and call the ones who are shipping.

Sources

• llms.txt standard: https://llmstxt.org
• Model Context Protocol documentation: https://modelcontextprotocol.io
• MDN HTTP headers reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
• IETF RFC 7489 (DMARC): https://datatracker.ietf.org/doc/html/rfc7489