Reading Website forensics results

After you run a Website Forensics search (see Website forensics search: overview), results populate the Search Results panel on the right. This page explains how to read and verify them. The Website Forensics results screen uses the same results component as every other search type, so the general model in Found, Enriched, Connections and Match Accuracy and the Results table reference applies directly.

Caution

No populated results screenshot exists for the Website Forensics search type in the reference build. The result-reading guidance below is described conceptually by reference to the general results model. The exact table columns and Details sub-sections that the Website Forensics Modules produce were not captured — the results table adapts its columns to the Module that produced them, so treat the specifics below as the general pattern, not a captured Website Forensics layout.

The three counters

Every populated results header carries the same trio of counters, in this order. They count three different things and must never be used interchangeably (colour coding: Found is green, Enriched is orange, Connections is white):

• Found — the identifier was located on a site / in a data source (a matching record exists there). For a Website Forensics lookup, this reflects what the underlying source holds for the domain (or, for the by-Email Module, the email).
• Enriched — UserSearch holds further metadata on a found record. Enriched is a strict subset of Found — only found records can be enriched. Enrichment coverage is Module / data source dependent.
• Connections — relationships/links surfaced between entities (linked clusters rather than raw hits). These are intended to populate the Graph tab.

Caution

A populated Connections graph has never been captured for any search type. In every captured state the connections detail area reads “No connections found” — and the Connections counter can be non-zero while the connections section is still empty. Do not assume a rendered graph will appear for a Website Forensics search.

The results table

The results panel has Search Results and Bookmarks tabs. Above the table, the header carries the Found / Enriched / Connections counter tiles and a row of action buttons — AI Analyse, AI Ask, Export, Clear:

• AI Analyse / AI Ask run AI over the result set — see AI Analyse & AI Ask. SargeBot / the AI features are model-agnostic.
• Export downloads the current results — see Export and reports.
• Clear (styled red/coral) empties the current results set.

The results table adapts its columns to the Module that produced them. In captured search types, single-site sweeps use columns like BOOKMARK · SITE · ENRICHED · CONNECTION · PROFILE URL, where ENRICHED and CONNECTION are independent per-row flags (a check or a red X). The Website Forensics composer was captured only in its empty state, so its populated columns were not observed.

Caution

Because no populated Website Forensics result was captured, the precise columns for the five Modules are not asserted. Expect Website Domain Ownership (by Domain) to surface WHOIS ownership, registration history and contact fields; (by Email) to list the domains registered under the email; Website Change History to list archived snapshots; 3rd Party Website Lookup to list its aggregated third-party findings; and Search by Favicon to list sites sharing the favicon. Verify against the on-screen table.

The Details panel

Selecting a row drives the lower-left Details panel, which renders the structured detail of that result across tabs — typically Details and Graph (a Profile View tab appears only for certain result types). Within the Details tab, content is organised into labelled sub-sections (for example, a summary of what was searched, connection tables, and an information block that is the concrete face of enrichment). Clicking Graph switches to the Connections graph view.

For the full anatomy of the Details panel, its sub-sections, and the Match Accuracy column (which is set by the third-party data source, not computed by UserSearch), see Found, Enriched, Connections and Match Accuracy.

Verifying a result

• Cross-check the Found and Enriched counters against the rows shown — Enriched should never exceed Found.
• Treat Match Accuracy, where present, as the data source’s own confidence, not a UserSearch computation.
• Use the pivot affordances beside a value to continue the search. Both the Google “G” dork and the separate magnifier / enrich icon open Google with a preset dork for the value (per Lee, 2026-07-10) — see The pivot.

See also: Website forensics search: overview and Website forensics modules & options.

Verified against UserSearch v2.0.20