NameSwitch Audit

Who it's for

Small EU web agencies and privacy consultants who currently use browser DevTools, curl, or a spreadsheet to check client pages after a DNS/provider switch.

The problem

Legal/time: hidden third-party analytics can make GDPR/ePrivacy disclosures wrong, and manual before/after diffing takes 3-6 hours per client site.

How to build it

Hosted web tool plus CLI: enter domain, baseline origin IP/hostname, and new nameserver/proxy; it fetches up to 5 pages through both paths, diffs scripts/headers, and returns JSON plus a signed PDF.

How it makes money

Agencies pay €49 per domain audit or €199/month for 20 client domains because they need client-ready proof and disclosure snippets; free curl/DevTools cannot store baselines, classify trackers, or produce signed audit evidence.

Why it doesn't exist yet

Incumbents skip: consent platforms sell enterprise banner management and broad crawls, not a cheap one-off switch-audit with signed evidence, and infrastructure providers have no incentive to expose their own injections. Indie gap: a focused diffing CLI with public tracker fingerprints and client-ready audit reports.

First users

The first 10 users come from the HN Cloudflare-injection thread, web-agency newsletters, and privacy-consultant communities where people are already asking how to prove what a provider added.

Build size

1 person x 8 weeks; includes DNS-resolver fetcher, HTML/header/script diffing, fingerprint DB for top 500 third parties, disclosure snippet mapping, signed PDF export, Stripe checkout; excludes authenticated pages, blocking/remediation, and enterprise SSO.

Biggest risk

Cloudflare or another large provider ships a native disclosure/opt-out for injected analytics, or changes injection so it is not visible to anonymous fetches, removing the core hidden-injection pain.

Conditions for a hit (all 3 required)

• Given a domain and baseline origin hostname/IP, the tool returns within 10 minutes a JSON list of script URLs, inline-script SHA-256 hashes, and response headers that appear via the new nameserver/proxy but not via the baseline.
• Each newly detected third-party resource is labeled with one category (analytics, advertising, support, CDN, unknown) and includes a copy-paste disclosure sentence plus the exact page URL or header where it was observed.
• The export includes a timestamped signed PDF/JSON verdict of PASS, REVIEW, or FAIL, with resolver details, response checksums, and a manifest of all detected changes.

How it's judged (in 6 months)

GitHub: a public repo implementing this shape reaches 1,000 stars, or Product Hunt: a matching launched tool reaches daily top 5.(judgment date 2027-02-17)

AI self-confidence 52/100 — self-reported likelihood of meeting the criterion, not a business success rate