Skip to main content
Typing a bare domain is the fastest way to find indexed apps that carry signals tied to an organisation. acme.com, https://app.acme.com/login, and domain:acme.com all run the same search.
A domain match is a search signal, not attribution and not proof that the domain owner operates the app. Public contact addresses, copied text, examples, and third-party integrations can all create legitimate matches.Periphery performs attribution only as part of its managed service, where Periphery investigates matched apps and attributes them to their owners.

​
What matches

An app matches a domain when any one of three signals matches:
  1. The hostname starts with the domain. Provider hostnames usually fold a custom domain into their slug, so acme-com.vercel.app and acme-com-dashboard.vercel.app match acme.com, and so does the host acme.com itself. The domain has to open the hostname and end at a . or -: acme-company.vercel.app and app.acme.com don’t match through the hostname, though they still match through the two signals below.
  2. An email address on the page is on the domain. A contact address such as security@acme.com creates a domain match.
  3. The page text mentions the domain.

​
How the domain is read

  • Schemes, subdomains, paths, ports, and credentials are stripped: https://user@app.acme.com:8443/x?y searches acme.com.
  • The suffix must be a real public suffix. acme.co.uk searches acme.co.uk; config.json and v2.1 are not domains and are searched as free text.
  • Several domains must all match. acme.com domain:acme.io and domain:acme.com,acme.io both return only apps matching both domains. This is the one filter whose comma-separated values AND together rather than OR.

​
When nothing matches

If a domain search returns no results, the console offers the domain’s name as a keyword search: acme.com becomes acme. That matches titles and page text that mention the name without the suffix, which catches apps that spell the organisation out but never link to its domain.