A website can reveal very little about its operator while still carrying the advertising infrastructure that helps it earn revenue. For investigators examining a domain that rehosts content or is suspected of fraud, that infrastructure offers another place to look when the site itself provides few useful ownership details.

Advertising identifiers, the identifying values associated with ads running on a website, can connect an otherwise anonymous domain to other sites. One of those connected sites may disclose a detail that the original doesn’t, giving the investigator a new lead to follow.

Security analyst Tushar Karumudi explores those connections through his scraping threat intelligence work, where he investigates who is behind observed activity and what motivates them.…