You Didn't Give Us a URL. Here's How Gumshoe Found It Anyway.
When you search a supplier by ABN, Gumshoe finds their website without you providing one. Here is how domain candidate matching works and what happens when a domain does not resolve.
When you search an ABN in Gumshoe, you do not type in a website address. You type a number, or a company name — and within seconds, Gumshoe has already checked the supplier's website for email security configuration, checked the domain's registration age, and looked for signs of an active online presence. None of that requires you to provide a URL.
This is the domain candidate system. It is one of the quieter parts of the verification pipeline, but it does a significant amount of work in the background.
The Problem with Business Names and Domain Names
A company registered as "COASTAL HYDRAULICS PTY LTD" does not necessarily own coastalhydraulics.com.au. They might operate as coastalhydro.com.au, or hydraulicscoastal.com.au, or simply coastal.net.au. The official registered name is almost never the domain name verbatim.
This creates a problem for automated verification. Without a domain, you cannot check whether the supplier's email security is configured correctly, how long the domain has been registered, or whether there is an active web presence at all. And asking suppliers to provide their own website address defeats the point — a fraudulent supplier will give you whatever URL makes them look most legitimate.
The domain candidate system solves this by working backwards from the registered entity name to a set of plausible domain names, then checking which of them actually resolve.
How the Candidates Are Generated
| Domain Status | Risk Level | Consequence |
|---|---|---|
| Domain Resolves | Low | No Disruption |
| Domain Redirects | Medium | Minor Inconvenience |
| Domain Not Found | High | Search Failure |
| Domain Parking | Medium | Irrelevant Results |
| Domain Expired | High | No Resolution |
When Gumshoe receives a company name from the ABR, it runs a normalisation process first. Business suffixes that add no signal are stripped: "PTY LTD", "PTY LIMITED", "PROPRIETARY LIMITED", "GROUP", "HOLDINGS", "AUSTRALIA". What remains is the core trading identity of the entity.
"COASTAL HYDRAULICS PTY LTD" becomes "coastal hydraulics". The system then generates candidate domain names by combining those words in different configurations:
- Full name joined: coastalhydraulics.com.au
- Full name hyphenated: coastal-hydraulics.com.au
- First word only: coastal.com.au
- First two words combined: coastalhydraulics.net.au
- Each combination across .com.au, .net.au, .au, and .com
For individuals trading as sole traders — where the ABR name format is "SURNAME, FIRSTNAME MIDDLENAME" — the system handles personal name inversion separately, generating candidates like firstname-surname.com.au and fsurname.com.au.
What "Resolves" Means
Resolution means the domain has a DNS A record — the domain name maps to an IP address. This is the minimum requirement for an active website. Gumshoe does not visit the website or render any content; it only checks whether the DNS record exists, with a 2-second timeout per candidate.
All candidates are checked in parallel. The result is a ranked list where resolving domains appear first. The highest-confidence resolving candidate — typically the .com.au with the entity's name — becomes the domain used for subsequent checks: WHOIS registration date, DMARC and SPF record inspection, and web presence scoring.
What the Domain Enables Downstream
Finding the domain is step one. Once it resolves, three additional checks run automatically:
WHOIS registration date. How long has the domain been registered? A domain registered less than 180 days ago, combined with a business entity created less than six months ago, is a meaningful signal — not conclusive, but worth noting alongside other indicators.
DMARC and SPF. Does the domain have email authentication records configured? A supplier sending invoices from a domain with no SPF or DMARC record is trivially spoofable. Many legitimate small businesses have not configured email security — but a supplier sending large invoices from an unauthenticated domain is a business email compromise (BEC) risk worth flagging.
Web presence scoring. Does the domain have an active website? Does the site appear to be a legitimate business presence — not a parked page, a domain squatter, or a placeholder? Gumshoe looks for signals of genuine business content: contact information, service descriptions, an about page.
The Limitation Worth Knowing
Domain candidate matching is probabilistic, not certain. The system finds the most likely domain for the entity; it does not guarantee that the domain found belongs to the entity. A common company name in a common industry — "NATIONAL CLEANING SERVICES PTY LTD", for example — may resolve to a domain owned by a completely different entity with a similar name. The WHOIS check partially mitigates this: if the domain's registrant information does not match the ABR entity details, Gumshoe notes the discrepancy.
The check is one signal in the overall risk picture, not a determinative one. When domain matching is uncertain, the other checks carry the weight independently.
Run a supplier through Gumshoe and the domain candidate results appear automatically — no URL required. For the suppliers where a domain matters most, the system finds it. For the ones where it does not exist, you will know that too.
Uncommon Insights
One of the lesser-known implications of the domain candidate system is its potential impact on ASIC's requirements for verifying the identity of suppliers under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). By automatically generating and checking multiple domain candidates, Gumshoe can help organisations meet their AML/CTF obligations more efficiently, particularly in cases where suppliers do not have a clear online presence.
The Corporations Act 2001 (Cth) requires companies to maintain accurate and up-to-date records, including details of their website and online presence. The domain candidate system can help organisations ensure compliance with these requirements by automatically checking for changes to a supplier's domain registration or web presence. This can be particularly useful in cases where suppliers have recently changed their business name or structure.
ATO's guidelines for verifying the identity of suppliers under the A New Tax System (Australian Business Number) Act 1999 require organisations to take reasonable steps to verify the identity of their suppliers. The domain candidate system can help organisations meet these requirements by automatically checking for inconsistencies between a supplier's registered business name and their online presence. This can help reduce the risk of false or misleading information being used in tax-related transactions.
ASIC's Regulatory Guide 221: Facilitating online financial services disclosures (RG 221) requires organisations to ensure that their online disclosures are clear, concise, and easily accessible. The domain candidate system can help organisations meet these requirements by automatically checking for the presence and accessibility of online disclosures on a supplier's website. This can help organisations ensure that their suppliers are meeting their regulatory obligations and reduce the risk of non-compliance.
Run a free supplier check in seconds
Search by business name, ABN, or ACN. Instant PASS/WARN/FAIL across 8 verification signals.
Start verifying →
