Notes/Timms Builds/BUILD

DIY GTM engine/2-part series

How to find every company that uses your competitor, part 1: the simple version

The cheapest lead in B2B is your competitor’s customer. A step-by-step recipe and one AI prompt to find them yourself, from public website and DNS data.

Nick Timms · 30 Oct 2026 · 9 min read

The shortcutFree · no sign-up

Build your GTM engine in one click

Opens with the GTM Engine prompt already loaded. Type your competitor’s name, approve five stages, and get a spreadsheet of their customers with the evidence for every row.

Build it in Claude 1 click Build it in ChatGPT 1 click

Using Claude Code, Codex or Cursor?Copy the promptHow to run it ↓

I was looking for new ways to reach customers for Drag. The teams most likely to switch to us were already paying for one of our competitors, and some of those competitors leave their code on their customers’ websites.

So we wrote a small script to crawl websites and look for that code. It started to work, so we kept scaling it.

This is that first version, written up as a recipe. I hope it’s as useful to you as it has been to us.

Why it works: the cheapest click in paid search is your competitor’s name, and the cheapest lead in outbound is your competitor’s customer. They’ve already decided they need what you sell, found the budget and learned the category. You only have to show you solve it better.

By the end you’ll have a spreadsheet of every company that uses your competitor, the evidence for each one, and the date you found it. No paid data. No scraping LinkedIn or Google. One prompt.

The recipe card

Serves

B2B founders whose competitor leaves a visible trace: chat widgets, booking, payments, forms, email, ecommerce, analytics

Prep

30 minutes

Cook

Under an hour for a few thousand websites, on a laptop

Cost

$0 to $20, if you already pay for Claude or ChatGPT

Makes

A spreadsheet: company, website, tool found, the evidence, the date

Skill level

Copy, paste, run one command. No coding

Ingredients

Four accounts, and you probably have all of them.

• Claude or ChatGPTA paid plan, so you get Claude Code or Codex. They write the scanner and run it for you.From $20 a month
• Node.jsWhere the scan runs. Claude Code installs it if it’s missing.Free
• Google ChromeFor finding your competitor’s fingerprint, with View Source and DevTools.Free
• Google SheetsWhere the finished list lives. Excel works too.Free

Also free, no account needed: the open-source webappanalyzer fingerprint library, and the Tranco top 1M list of websites.

You don’t need proxies, a database, a server or any paid data API. Those come in part 2, and that’s where the bill starts.

Method

1. Check your competitor leaves a mark (10 minutes)

Open your competitor’s customers or case studies page and pick three companies. Visit each one’s website.

Right-click, View Page Source, and search (Cmd+F) for your competitor’s name. Then open DevTools → Network, reload, and search there too. You’re looking for a script, a cookie or a request that only their product would make. Two examples:

• HubSpot loads a script from js.hs-scripts.com
• Intercom loads its chat widget from widget.intercom.io

Nothing on the website? Check the DNS records. Many tools ask a company to add a record to verify their domain or send email, and those records are public. Type the domain into any free DNS lookup and look at TXT and MX:

• DocuSign leaves a TXT record starting docusign=
• Atlassian leaves atlassian-domain-verification
• Google Workspace shows up in MX as google.com, Microsoft 365 as mail.protection.outlook.com

Found it on all three? The recipe will work. Found nothing? Read where it goes wrong before you go further.

2. Write the fingerprint (5 minutes)

A fingerprint is a short rule: where to look, and what to match. Write one line per signal.

• Script URL: widget.intercom.io
• DNS TXT: docusign=
• Page variable: window.Intercom

Two signals beat one. Match the script or the record, never just the brand name, or every blog post that mentions your competitor becomes a “customer”.

Shortcut: the open-source webappanalyzer repo carries on Wappalyzer’s library from before it went private in 2023. It has ready-made fingerprints for over 7,000 tools. Search it for your competitor and copy theirs.

3. Build the list of websites to check (15 minutes)

This is the step everyone gets wrong. The scanner is only as good as the list you feed it. In order of hit rate:

Clean it before you scan: lowercase, strip www., remove duplicates and your competitor’s own domains. One domain per line in domains.csv.

4. Run the scan (under an hour)

Paste the prompt into Claude Code or Codex. It writes a small script that, for each domain, loads the homepage and its headers, looks up the DNS TXT and MX records, checks them against your fingerprints, and writes a row: domain, tool, the evidence it matched, today’s date.

Be polite. The script names itself, respects robots.txt, checks a few sites at a time and never logs in to anything.

5. Check the first 20 by hand (10 minutes)

Open 20 matches and confirm the tool is really there. When you find a false match, tighten the fingerprint and run it again. Run it against your test set too: if it misses known customers, a signal is missing.

6. Serve

Open results.csv in Google Sheets. This is what it looks like:

7. Run it again next month

The second run is where it gets interesting. A company where your competitor’s script has disappeared may be shopping for a replacement. Check twice before you trust it, though: a site that failed to load looks exactly like a cancellation.

The promptv1 · free to use

The GTM Engine

One prompt that finds every company that uses your competitor. Open it in Claude, type their name, and say “go” five times. You get a spreadsheet with the evidence for every row.

Build it in Claude 1 click or ChatGPT

5

stages, each approved by you

1

line to fill in

~1 hr

start to spreadsheet

$0

spent on data

What happens when you send it

1. 1Finds companies you know use itknown.csvReads your competitor’s customers and case study pages and pulls 10 to 20 of them. This is the test set.
2. 2Works out the fingerprintfingerprints.jsonFinds the script, cookie or DNS record only your competitor leaves, then proves it catches the known customers and nothing else.
3. 3Builds your list of websitesdomains.csvAsks where you sell, then gathers the websites to check, best sources first.
4. 4Checks every websiteresults.csvVisits each homepage politely, reads its DNS records, and keeps the exact evidence for every match.
5. 5Hands you the listhistory.jsonTotals, the best matches, and one command to run it again next month to see who’s new and who’s left.

It stops after every stage and waits for your “go”, so nothing runs that you haven’t seen.

The prompt · 450 wordsCopy

You are my GTM engineer. Build me a list of companies that use my competitor, from public website and DNS data only.

COMPETITOR: [e.g. Intercom]

Work in five stages. At the end of each stage, show me what you found and wait for my "go" before starting the next one.

STAGE 1 - KNOWN CUSTOMERS
Find COMPETITOR's customers, case studies and integrations pages. Pull 10-20 customer domains from them and save them as known.csv: this is the test set. Also pick 20 popular sites from unrelated categories as a control set (control.csv).

Read the whole prompt

Using Claude Code or Codex?›

They run the scan for you too. Copy the prompt, then in an empty folder run claude "$(pbpaste)"

Copy promptCopy command

When it’s done you’ll have results.csv to open in Google Sheets, fingerprints.json to reuse for the next competitor, and history.json, which turns next month’s run into a list of who’s new and who’s leaving.

Where it goes wrong

Your competitor leaves no trace. Browser extensions, desktop apps and anything behind a login are invisible from the outside. This is our own problem with Drag: some of our competitors live entirely inside Gmail, so they never show on a website. What we can see is Google Workspace in a company’s MX records. That’s not their competitor, it’s their market, and sometimes that’s enough.

The script loads late. Some tools only load after a cookie banner is accepted, or through a tag manager. A plain page fetch misses them. Fixing that needs a headless browser, which is part 2.

False matches. A blog post comparing tools, a “vs” page, an old script left in a footer. Match the script URL or the DNS record, never the name, and check 20 by hand every time you change a fingerprint.

Sites that block you. Some sites challenge anything that isn’t a browser. Don’t try to get around it. Log it and move on.

The maths. This is the one nobody mentions. In our data, Intercom shows up on about 15,000 of the 35 million websites we’ve profiled: roughly 1 in 2,300. Scan a random 10,000 sites and you’ll find a handful. That’s why step 3 matters more than the scanner, and why lookalikes come last.

Stops are hard to prove. A tool going missing can be a cancellation or a page that failed to load. Two clean checks before you believe it.

Being a good citizen. Public pages and public DNS only. Name your bot, respect robots.txt, keep it slow, never log in anywhere, and follow the cold email rules where you sell before you contact anyone on the list.

The money

This version costs what your AI plan costs. Here’s how that compares with buying the same list, and what the list could be worth to you.

When DIY stops being worth it

This recipe is genuinely good for one competitor and a few thousand websites. Use it.

It stops being worth it when you want everyone. That means finding tens of millions of websites to check, rendering the ones that load late, checking DNS at scale, rechecking every company each month, and testing your own accuracy every night. That’s what our afternoon script turned into, and it’s a different job.

Ady is crawling

Skip the build

Or see your competitor’s customers in one search

Our afternoon script grew into AgentData. It checks company websites and DNS records around the clock, keeps the evidence for every detection, and flags the companies that just started using a tool.

133M

companies tracked

35M

websites profiled

196M

detections, with evidence

4,281

tools tracked

Who’s your competitor?

See their customers →

Try:IntercomZendeskHubSpotHelp ScoutShopify

Free to look up, no account needed. Full lists, downloads and new-customer alerts from $99 a month, with a 7-day trial and no card.

Ask it from Claude or ChatGPT →

Full disclosure: AgentData is ours. Everything above works without it.

If you build this, reply and tell me which competitor you pointed it at. I’ll share the best ones next week.

Sources: AgentData data quality, how AgentData detects tools, webappanalyzer, Tranco. Numbers as of 30 October 2026.

Know a founder who needs this?

“The cheapest lead in B2B is your competitor’s customer. Here’s how to find every one of them yourself, with one prompt.”

Post on X Share on LinkedInCopy linkCopy link to the prompt