← all plays

Footprinting

Build a competitor's customer list

Pick any software tool. The companies that use it leave tracks all over the internet. They link to it. They get a little web address handed to them by it. Those tracks are public, and a tool called Ahrefs has already collected them. You just have to ask.

This is the play I use when I want every company that uses a specific tool. Not a sample, the whole list. It works because software that lives online can't really hide its customers.

There are two trails. You want both.

The link trail. When a company starts using a tool, it tends to link to it somewhere. A "powered by" note, a partner badge, a little credit in the footer. Ahrefs keeps a giant index of who links to whom. Ask it who links to the tool's website and a big chunk of the customer list falls out.

The web-address trail. This one is even better. A lot of software gives every customer its own little web address on the company's own domain. Something like acmecorp.thetool.com. That address is a dead giveaway that Acme Corp is a paying customer. Pull every one of those addresses and you've got a list of actual accounts, not guesses.

How to pull it

Ahrefs has a way to ask for both trails directly, no clicking around. If you don't pay for Ahrefs, there's a free version of the trick: a public record of website security certificates (every site that ever got the little padlock is listed) plus some clever Google searches. Slower, but the data is public either way.

# the idea, in plain terms 1. ask: who links to thetool.com? # the link trail 2. ask: every address ending in # the account trail .thetool.com 3. turn each one into the real company 4. drop anyone you already had

Then clean it up

A raw web address isn't the company, it's just the account name. acmecorp.thetool.com needs to become acmecorp.com, the real business. Sometimes the address forwards you straight there. Sometimes you search the name. Then you remove anyone you already know about, so what's left is genuinely new.

competitor_customers.csv · 6 of 308
Account foundReal companyFound viaStatus
northwind.thetool.comnorthwind.coaccountlive
helix.thetool.comhelixlabs.ioaccountlive
fairmont-supply.comlinklive
parkway.thetool.comparkway-co.comaccountlive
brightside.studiolinklive
ridgepoint.thetool.comridgepoint.coaccountlive
both trails merged · names made upduplicates removed

What you end up with is a competitor's customer list, built entirely from public information. From there you can go figure out what else each one uses, or find the right person to email at each one.

How it works under the hood

What it uses

Link trail
Ahrefs, who-links-to-who
Account trail
Ahrefs list of web addresses
Free version
Public certificate records
Clean up
Turn accounts into real companies

Worth knowing

Account isn't the URL
The address is the account name, not the site.
Dead accounts
Some have churned. Check before trusting.
Get all of it
Big lists come in pages. Pull every page.
Use both trails
Each one catches what the other misses.

Want a competitor's customer list?

Name the tool. I'll pull who uses it.

You'll get the companies running it, cleaned and de-duplicated.

Free to do yourself. All the plays are right here.

Keep going