Shared hosting was never the only thread stitching a network of websites together, but it’s still the first thing operators try to hide. Search engines, ad platforms and human reviewers almost never act on a single data point. They correlate. Dozens of attributes get lined up until a cluster becomes statistically hard to wave away. A footprint here means any repeated, low variance attribute that survives across properties: a config choice, a habit, an identifier nobody bothered to change. I’ll walk through ten signal families, why each one leaks, and what operators of legitimate multi site portfolios actually do to cut accidental overlap. Agencies, franchise groups, multi brand publishers - they all have honest reasons to run many domains at once, and they’re the ones who gain most from mapping their own correlation risk before somebody else does it for them.
Why IP Diversity Stopped Being the Whole Story
Cheap proxy hosting made address separation trivial. So detection moved on, toward attributes that cost real effort to vary. The logic is cumulative, not binary: one weak match proves nothing, twelve weak matches landing at once produce a confident cluster. Analysts split these into deterministic identifiers - an analytics property shared across domains, say - and probabilistic ones like writing rhythm or publishing cadence. The first connects sites with no inference at all. The second needs statistical weight, but in volume it gets damning.
And the cost asymmetry favours whoever is looking. An operator has to diversify every layer, consistently, forever. A reviewer needs one lapse anywhere in the stack. Five categories organise what follows: infrastructure, identity, code, content and behaviour. Most portfolios fail in the layers their owners never thought of as public. Address level separation still matters as a baseline, which is why geographically distinct IP ranges remain the starting point rather than the finish line.
Signals One to Three: Infrastructure and Registration Traces
Signal 1 - DNS and nameserver configuration. Identical nameserver pairs, matching TTL values, reused MX records, the same SPF include string. These tie brands together instantly. When four supposedly unrelated companies all route mail through one niche provider using the same custom hostname, the coincidence story collapses. The same applies to reverse DNS and PTR records, which quietly expose the hosting relationship behind every address you use.
Signal 2 - registrar and registration pattern. One registrar, one privacy proxy, bulk registration dates, renewal cycles moving in lockstep, sequential naming schemes. Anyone can reconstruct that timeline in an afternoon.
Signal 3 - TLS certificates. Sharing a certificate authority is normal. Listing sibling domains as SAN entries on one certificate is a direct link, no interpretation needed - same goes for certificates issued within the same minute. Certificate transparency logs archive all of it permanently and publicly.
- DNS - artefact: zone records queryable by anyone, cached indefinitely by third party history services.
- Registration - artefact: WHOIS history snapshots taken before privacy was enabled.
- TLS - artefact: CT log entries that cannot be deleted or amended after issuance.
Tip: search certificate transparency logs for your own domains before anyone else does, and reissue any certificate that names siblings you would rather keep separate.
Signals Four to Six: Code, Analytics and Third Party Identifiers
Signal 4 - tracking and monetisation IDs. Analytics properties, tag manager containers, ad network publisher IDs, affiliate parameters, forgotten verification meta tags still sitting in the document head. Strongest evidence there is, because none of it requires interpretation.
Signal 5 - theme and plugin fingerprints. Identical child theme folder names. Untouched template comments. Matching plugin sets, including the obscure ones nobody installs by accident. Shared favicon hashes, images run through one compression pipeline. All pointing the same direction.
Signal 6 - build and asset artefacts. Unchanged CSS class prefixes, byte identical minification output, shared CDN paths, sitemap or robots files matching line for line. That’s a common toolchain, plain as day.
Hash level identity carries far more weight than surface visual similarity. Two sites can look alike because one person has one taste. They rarely produce matching checksums by chance.
Tip: strip generator meta tags and rebuild default sitemap structures so your stack is not announcing itself in the markup.
Tip: treat a reused favicon as a fingerprint, not a branding shortcut - it is one of the most frequently overlooked matches.
Signals Seven and Eight: Content, Language and Editorial Habits
Signal 7 - stylometric overlap. Sentence length distribution, punctuation preferences, favourite transitional phrases, heading formulas, recurring metaphor sets. All of it survives a rewrite. And boilerplate copied verbatim between legal pages removes whatever doubt was left.
Signal 8 - structural content patterns. One article template, a narrow word count band, consistent internal link density, duplicated category taxonomies, author bios spun out of a single paragraph. Same skeleton under different paint.
Privacy policies, terms pages, contact copy: simultaneously the most duplicated and the least reviewed text on any site. Nobody rereads them. Machine generated content makes it worse, because model defaults repeat across outputs unless a writer steps in and breaks the pattern on purpose. Anyone working through the wider technical SEO of site networks runs into the same tension between efficiency and sameness.
- Legal and policy pages, rewritten independently per brand.
- Author biographies and editorial mission statements.
- Category and tag taxonomies, including their ordering.
- Standard calls to action and form microcopy.
- Meta description templates and title tag patterns.
Signals Nine and Ten: Linking Topology and Behavioural Timing
Signal 9 - link graph shape. Reciprocal patterns, identical outbound neighbourhoods, mirrored anchor text distributions, links landing in the same page position across properties. That describes a network topology, not organic citation. When one outreach list serves every brand, the backlink profiles converge on the same referring domains in roughly the same order.
Signal 10 - temporal behaviour. Publishing at the same hour. Deploying updates in one batch window. Coordinated indexing requests. Matching timezone metadata left in feeds and image EXIF. One human calendar behind many logos. Timing resists faking precisely because it reflects working habits rather than configuration - you’d have to change how you live, not what you set.
Tip: stagger publication schedules across properties and strip EXIF metadata before upload; both are cheap fixes that remove genuinely hard evidence.
Auditing Your Own Portfolio Without Guesswork
Build a matrix: properties down one axis, the ten signals across the other. Score each cell unique, partially shared or identical. The picture is usually worse than expected, and a lot more actionable than intuition. Fix the deterministic identifiers first, since those connect sites with zero inference required. Portfolios past a handful of domains usually reach the point where dedicated hosting and separation services cost less than the manual upkeep of pretending.
Openly connected brands are a different case entirely. When transparency is the point, shared elements are just corporate structure made visible. Nothing to remediate.
- Remove stale verification meta tags and unused tracking containers.
- Rewrite legal boilerplate per property rather than copying it.
- Split certificates so no SAN entry names a sibling domain.
- Diversify nameservers and mail routing across providers.
Tip: document deliberate shared elements internally, so a manual reviewer reads intent instead of concealment.
Tip: repeat the audit after every migration, redesign or agency handover, because rebuilds reintroduce defaults.
Summary
Clustering comes from accumulated small matches, never one decisive marker. A network gets identified the way any pattern gets identified: enough coincidences stacked in one place that chance stops being a credible explanation. And intent matters enormously. Being transparent about related properties is defensible and often commercially smart, while concealment attempts rarely survive sustained scrutiny - keeping perfect separation across five layers indefinitely is harder than most operators assume.
The durable answer is real differentiation. Distinct editorial voices, independent technical decisions, separate toolchains. Not superficial obfuscation, which only delays recognition. Treat every shared configuration decision as a signal you are choosing to publish, because that is exactly what it is.
