# .lu Domain Lead Generation — Research Findings

Research on data sources, APIs, legal requirements, and cost analysis for the prospecting module.

## 1. Data Sources for .lu Domains

The official .lu registry (DNS-LU / RESTENA) does **not** publish zone files. All providers use web crawling to discover domains, so no list is 100% complete. Expect 70-80% coverage.

### Providers

| Provider | Domains | Price | Format | Notes |
|----------|---------|-------|--------|-------|
| NetworksDB | ~70,000 | $5 | Zipped text | Best value, one-time purchase |
| DomainMetaData | Varies | $9.90/mo | CSV | Daily updates |
| Webatla | ~75,000 | Unknown | CSV | Good coverage |

## 2. Technical APIs — Cost Analysis

### Technology Detection

| Service | Free Tier | Notes |
|---------|-----------|-------|
| CRFT Lookup | Unlimited | Budget option, includes Lighthouse |
| Wappalyzer | 50/month | Most accurate |
| WhatCMS | Free lookups | CMS-only |

**Approach used**: Custom HTML parsing for CMS, JS framework, analytics, and server detection (no external API dependency).

### Performance Audits

PageSpeed Insights API — **free**, 25,000 queries/day, 400/100 seconds.

### SSL Checks

Simple HTTPS connectivity check (fast). SSL Labs API available for deep analysis of high-priority leads.

### WHOIS

Due to GDPR, .lu WHOIS data for private individuals is hidden. Only owner type and country visible. Contact info scraped from websites instead.

## 3. Legal — Luxembourg & GDPR

### B2B Cold Email Rules

Luxembourg has **no specific B2B cold email restrictions** per Article 11(1) of the Electronic Privacy Act (applies only to natural persons).

**Requirements**:
1. Identify yourself clearly (company name, address)
2. Provide opt-out mechanism in every email
3. Message must relate to recipient's business
4. Store contact data securely
5. Only contact businesses, not private individuals

**Legal basis**: Legitimate interest (GDPR Art. 6(1)(f))

### GDPR Penalties

Fines up to EUR 20 million or 4% of global revenue for violations.

**Key violations to avoid**:
- Emailing private individuals without consent
- No opt-out mechanism
- Holding personal data longer than necessary

### Recommendation

- Focus on `info@`, `contact@`, and business role emails
- Always include unsubscribe link
- Document legitimate interest basis

## 4. Cost Summary

| Item | Cost | Type |
|------|------|------|
| Domain list (NetworksDB) | $5 | One-time |
| PageSpeed API | Free | Ongoing |
| Contact scraping | Free | Self-hosted |
| Tech detection | Free | Self-hosted |

Working MVP costs under $25 total.